>It was an international group of at least three people (known so far), and likely more.
I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers.
>But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable.
While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that.
Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.