“Highlights a security breach with a measured, procedural tone focused on audit and policy review rather than panic.”