Firms look to limit liability after hacks