US insurance regulator halts risk designations after cyber attack