I'm actually curious, if there is anyone here that's actually an expert on this stuff can you explain<p>(1) How do you tell a state actor from just hackers looking to make money?<p>(2) Is this a solvable problem?<p>I can't imagine most state agencies, hospitals, doctors offices, small businesses, being able to afford good experienced IT staff. I can't imagine outsourcing it to nearly any company and trusting that company. Exceptions might be Google or Apple but neither company provides more than email/docs/spreadsheets. They don't supply bookkeeping, appointments, medical record management, etc... and AFAICT, all the suppliers for those kinds of services have terrible security practices. And, even if Apple and Google could do a good job there's still social engineering.