I would attribute this to both, - (unquestionable) the attackers but as well as - the IT-department that did not fix serious vulnerabilities (of an apparently

I would attribute this to both, - (unquestionable) the attackers but as well as - the IT-department that did not fix serious vulnerabilities (of an apparently mission critical system) We have that in all kinds of places: If you neglect your duties on maintenance or diligence in areas where humans could be harmed (electrical installations, fire safety, construction, whatsoever), you are liable for whatever happens. I don't see why IT should be somewhat special. The Citrix patch came out half a year(?) in advance.