Should companies be held liable for losses sustained in an attack on their Accounting Information Systems by outside sources