Employers need to protect benefit plans against cyberattacks