Medical test company’s ‘serious and systemic failures’ led to cyber-attack, watchdog says