[dnbgfher]

Mm. Perhaps I should have been a little more explicit. I never meant to imply any business should be able to handle a nation-state attack. That's not feasible.

It doesn't mean they get to clean their hands of the whole thing either. They failed, and that's fine as long as they weren't being negligent. But they are still responsible for doing what they can to minimize the damage. That means, for one, informing those impacted about what is known.

So, just to be super explicit. I don't expect a business to withstand a nation-state attack. I do however expect them to do what they can to minimize the damage afterwards.