I have to say at first I felt the same way most of the other commenters did: Claiming this was a state-sponsored attack is a convenient scapegoat. I'm still sk

I have to say at first I felt the same way most of the other commenters did: Claiming this was a state-sponsored attack is a convenient scapegoat. I'm still skeptical, but I wouldn't dismiss it outright. I think in the next 6-12 months, if a wholesale PII marketplace doesn't appear, the odds of a state-sponsored attack go up dramatically. The economics of wholesale fraud are such that you make money selling to other fraudsters, not trying to exploit the information yourself (setting up new accounts, taking over existing accounts, etc..). For what it's worth, even if this attack was executed by actors unaffiliated with the government, this information WILL make it's way to intelligence organization(s) in their home country. Unlike in the US, foreign and domestic intelligence services maintain a much closer relationship with the hackers in their home country.