“Formal notification of a security breach is inherently negative but framed as a routine corporate disclosure rather than an emergency.”