"Cybercriminals were able to breach defendant's systems because defendant failed to adequately train its employees on ...