Cybercrime costs US companies $21.2M per year, study finds