I would assume that the jurisdiction would be determined for some intentional harmful act (as opposed to a computer network event - the crime, if any, is that a person did something not that a technical thing happened), and the more relevant states would be the ones where the actor was located and the legal residence of the organization who suffered damages; the location of any involved hardware may have an impact (especially in the discovery process) but they're secondary to that.