Sure, it's possible it was a state-sponsored attack, but that mostly doesn't matter. What matters is that this system should have never been set up in the first

Sure, it's possible it was a state-sponsored attack, but that mostly doesn't matter. What matters is that this system should have never been set up in the first place. There's no reason that we need to consolidate this data into one big target, and then put that target into an easily breachable safe.