I reject that I said they had it coming.

My point is that re-securing their network does not seems like a financial damage to me. If they had known about their vulnerability beforehand, I'm sure they would've spent the time and money to fix it then.

Plus it's something they needed to do anyway.