> They are largely unsophisticated on financial and business matters so do not know how much to ask for, how to maximally leverage a breach as a first party (i.

> They are largely unsophisticated on financial and business matters so do not know how much to ask for, how to maximally leverage a breach as a first party (i.e. do not know how to use say investment bank deal details to do effective trades), and how to actually cash out large amounts of money undetectably. I wonder how many actually sophisticated attackers gain access to banks and other companies and purposefully keep a low profile but skim off low-bandwidth information meant for internal communications only, then aggregate and sell the intel to hedge funds or trade stocks on their own. Maybe the reason why we think that most attacks are caused by unsophisticated actors is because those are the one who are actually detected. Just kind of an interesting hypothesis that I’ve heard variations of before.