Software company lacked ‘downstream’ liability for data breach