U.S. cybersecurity agency warns of "grave risk" after hack