[wahern]

Presumably all medium and large corporations have been hacked. I don't think I've ever worked at an organization that hasn't been hacked. And all but one were hacked multiple times, though I'm sure that's because I just wasn't privy to the other incidents (the company may not have been, either). For criminal organizations it's just a numbers game--penetrate as many organizations as you can and then look for monetization opportunities. For many nation-states the calculus probably looks much the same, and in any event the techniques are similar.