An unauthorized-access incident in a regulated drugmaker’s internal systems is a reminder that business continuity and data security can fail on different timelines.