They're not a government organization. Haven't been for almost 10 years
Though I think it’s even worse if a publicly traded company fails to protect its data and falls prey to the extortion. Don’t they have a fiduciary responsibility to their shareholders? It seems wrong to waste their money due to incompetence at such basic infosec.
Government orgs are more difficult to hold accountable for losses than PLCs.