That's a great question where there's not an easy answer, to be honest. Choice of law (the question of which state's law apply) is a complex field with each state having its own rules as to how it decides. It's also a separate question from where you can sue for a particular thing. So it's difficult analyze either question in the abstract.

I would assume that the jurisdiction would be determined for some intentional harmful act (as opposed to a computer network event - the crime, if any, is that a person did something not that a technical thing happened), and the more relevant states would be the ones where the actor was located and the legal residence of the organization who suffered damages; the location of any involved hardware may have an impact (especially in the discovery process) but they're secondary to that.