Cyberattacks are creating a new litigation battleground, as more courts find that employers have a common-law duty to safeguard employees' sensitive information.