Well if it’s an SQL injection attack, which is a very common way of hacking web sites, there is no way to even know it happened. Unless you keep a record of everything users input into text boxes you have no way of knowing. The intruder takes the data and he’s off and you have no indication that something went wrong. You’ll have a spike in your database usage if someone requested a SELECT * query but unless something odd happens chances are you won’t go looking for it.

I can't remember the industry ever being so imbalanced towards the black hats.

The industry was always imbalanced. If we go ten years back spam for example was a menace, today not so much. There are always fights won and lost. The problem nowadays is that e-commerce is exploding and a single hack can turn up to be huge. You hack into a site and you end-up with 150mm credit cards (aka the Target case). Ten years ago not even Amazon had such a big customer base.