Despite major cyberattacks, businesses have been slow to react