I hate to sound like my parents/grandparents but I absolutely knew that causing millions of pounds of damage and attempting to blackmail a major corporation could have huge negative consequences for people and myself at 17.

I'm not saying the system wasn't poorly implemented but, society doesn't work when people abuse everything either. Maybe that just means we're doomed but most of society works because people don't go around smashing and/or taking everything they possibly can.

It’s also unclear if this was everyone, or just who they caught. It’s not unknown for hacking groups to position the youngest (least experienced, most desperate for recognition) people in the most vulnerable positions.

"After a frantic search that entailed calling hundreds of IT admins in data centers around the world, Maersk’s desperate administrators finally found one lone surviving domain controller in a remote office—in Ghana. At some point before NotPetya struck, a blackout had knocked the Ghanaian machine offline, and the computer remained disconnected from the network. It thus contained the singular known copy of the company’s domain controller data left untouched by the malware—all thanks to a power outage... So the Maidenhead operation arranged for a kind of relay race: One staffer from the Ghana office flew to Nigeria to meet another Maersk employee in the airport to hand off the very precious hard drive. That staffer then boarded the six-and-a-half-hour flight to Heathrow, carrying the keystone of Maersk’s entire recovery process."

https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

edit: wow, fun is cancelled for today it seems

The reality is that decreasing costs is a far easier lever to pull than increasing revenue so managers will be heavily incentivised to do this if you give them profit-based incentives. This happens every few years with listed companies in the UK now, no-one ever changes their behaviour (retail, in particular, is ground zero for bluffers in the UK, managers are exceptionally bad, and even worse are comp committees that set targets that cannot be achieved without damaging long-term value).

There is no efficient market here. It is as simple as managers understanding the world we now live in, and that is unlikely because all these companies view IT as a cost and their managers are people who rotate through executive roles and politics despite leaving a flaming wreck in their wake. Things will stay the same.

... be replaced by more competent companies

If the impact is large enough, they do.

This not a case where binary thinking works for most situations, though. The costs associated with the attack will hurt them by damaging their balance sheets a little bit, taking capital away from more productive opportunities, and distracting their employees from more fruitful tasks.

There’s always a public thirst for immediate blood in these situations, but the damage is more subtle and manifests more as opportunity cost than a sudden collapse of the company. The demand for sudden stock market collapse of companies is ironic, given all of the criticisms thrown at companies for putting too much emphasis on short term stock results.

When you know its going to happen, and then it happens because you did nothing - yeah, its your fault.