Any negative news that can influence the share price is material information. A hack, involving payment means, of 500M users is definitely material information.

Also. As the excellent Matt Levine never ceases to repeat : everything is securities fraud.

If you didn't state in your regular filings "our security is poor, we may get hacked", then you lied by omission.