$1 million fine for cybersecurity incidents in case full of lessons in what not to do