“Alarming security breach headline emphasizes account takeover vulnerability; mitigated only by mention of fix without detail on scope or user impact.”