HSE was in 'uniquely vulnerable position' at time of cyberat