Attorney general calls the company's security measures "lax" and says the company failed to adequately investigate warnings its systems had been compromised.