“Frames a security breach as a systemic failure by highlighting the company's three-month delay in alerting the government.”