Because essentially all networked IT systems are extremely easy to attack. These attacks probably cost ~$10k to pull off. If you can get $4M, like in the pipeli

Because essentially all networked IT systems are extremely easy to attack. These attacks probably cost ~$10k to pull off. If you can get $4M, like in the pipeline attack, by paying $10k and have no moral compunctions about it, why would you not be exploiting it as ruthlessly as you can and expanding your operations as quickly as you can to exploit the entire market? So, really there is nothing surprising about the current rash of attacks if you know the actual level of security we can expect. The real question is why it took so long for people to turn $10k into $4M and reinvest that $4M into 400 more $10k attacks with $4M payouts. Now, somebody will say something like: "Everybody knows these companies don't care about security. If they just focused on security and adopted best practices or (insert basic practice here) they would not be having these problems." Sure, these attacks are utterly trivial to implement and the target companies are massively behind the curve on "best practices" by orders of magnitude. But, even the best systems are completely and utterly ridiculously inadequate. You can completely and utterly compromise essentially any currently deployed commercial IT system for less than $10M with the median for total compromise of a Fortune 500 company being ~$100k. And frankly, $10M is just me sandbagging the upper bound. I have never had any person in any security organization from an engineer to a regional cybersecurity director to a CISO at a Fortune 500 company ever give a number over $1M when asked over lunch. For third party evidence, you can just look at Zerodium where they pay for exclusive rights to zero days in the most "secure" products currently available for only slightly more than $1M. You can literally burn multiple remote zero-click full-chain RCE zero days per attack and you would still be spending less than $10M per attack. If you can leverage a single remote zero-click full-chain RCE zero day even 10 times the cost per attack drops to the $100k-500k range. So sure, they could improve their security by a factor of 100x, bringing it from $10k to $1M. That might stop some criminals for a time. They might attack cheaper targets for a time. But if they can pay $1M to get $4M from you, then once they eat all the other fish in the barrel they are going to eat you.