A lot of people seem to feel like 'state-sponsored attack' and 'attack enabled by massive security management problems' are mutually exclusive. It is completely

A lot of people seem to feel like 'state-sponsored attack' and 'attack enabled by massive security management problems' are mutually exclusive. It is completely possible, and history indicates very likely, that Equifax was both massively incompetent and attacked by a state-sponsored organization. The state actors are working very hard to find these kinds of vulnerabilities, so it makes perfect sense that gaping security issues are being exploited by the people who are putting the most time into finding them.