I find this kind of reporting really disingenuous. They had to spend money to properly train and secure their employees due to the hack? No. They didn't do the basics and added it to the RAP sheet for the criminal. The SEA hacker deserves what he got, but your spend was not their fault, rather you just didn't do the basics that could have prevented his crime to begin with.

https://www.securityweek.com/syrian-hacker-gets-prison-time-in-us-after-over-a-decade-on-the-run/