The case is said to be the first legal dispute over how companies recover the costs of a cyber attack