Maybe this attacker gets into a few generic companies like accountants, builders, marketers. Nothing really valuable beyond the scope of the particular company

Maybe this attacker gets into a few generic companies like accountants, builders, marketers. Nothing really valuable beyond the scope of the particular company and their customers. Maybe they find their way into a oil/gas/mining operation, specialised software development company or everyone's favourite example, the electrical grid/water systems. Without data to back it up, I think that most attackers don't want to cause nation-wide problems and are motivated by money or revenge against a specific target. The biggest risk for them is if they did nation-wide damage whether deliberately or accidentally they might be on the receiving end of a response similar to OBL. Whether or not that would happen I don't know but it's the perception that matters. My biggest reason for hope is that the people I've seen working in government and large corp security have been skilled, aware of the risks and are ready to put in the work keeping systems safe.