“Neutral factual reporting on a corporate security incident and regulatory review, implying reputational risk without dramatic catastrophizing.”