I second this. As someone who works in infosec, there are ransomware gangs sitting on dozens after dozens companies' networks idle because they can't get enough

I second this. As someone who works in infosec, there are ransomware gangs sitting on dozens after dozens companies' networks idle because they can't get enough people to get to them and do the manual work in time. On average it takes them like a day before they start lateral movement. These are not sophisticated elite hackers. If I had to guess the number of individuals that can pull of a sophisticated attack (0 day, at least develop exploit from a cve report/patch, target specific implant/c2, knowledge of how to evade enterprise EDRs) is in the hundreds if not thousands. Most of them don't work for governments. Ransomware actors get caught because naturally their attack is meant to be discovered. If they decided to silently drop implants everywhere, how many companies do you think can afford to pay for forensics/IR at a massive scale, even if an intrusion is found? Also, who said it was a hack? It could have been an employee that obtained enough access to get the docs and avoid audit logging.