Cyberattacks in U.S. cost an average $8.9 million annually to clean up, study says