I may of missed something, but I understood that these were direct attacks that exploited phishing attacks. Was she advised to do something, or allow other people to do something that she denied?

IMHO the statement should be

> I'm devastated that this happened despite our best efforts to prevent this type of attack, and this is what we are going to do to try and make this right.

With the ability of AI to generate pitch perfect voices, it's getting harder to vet things. Especially if the person has already been phished.

Obviously if Co-op were negligent in their handling of member data they're also guilty of something. But even the best organisations have some level of exposure to phishing related attacks.