What I was saying is that at least in the US any bad thing that happens to a company can be treated as securities fraud. Company had security breach but they said they follow best practices. There likely will be a lawsuit saying that they mislead investors. Not saying it makes sense more pointing out that companies often do get sued for statements they make.