Report says boy accessed sensitive data about military projects before reporting breach to national cyber directorate, which alerted the military