Microsoft slammed for lax security that led to Exchange Online attack