Companies should not be held liable for losses sustained in a successful attack made on their AIS by outside sources