“Neutral reporting on a security lapse and corporate response, focusing on data exposure risk without alarming language.”