Is the issue that there was a lack of technical investment in security or a shortcoming in their ability to communicate with their customers? I'd argue many of

Is the issue that there was a lack of technical investment in security or a shortcoming in their ability to communicate with their customers? I'd argue many of the companies mentioned have invested heavily in security. Whether their investment will prevent a compromise from a determined adversary is likely unrelated to their investment. Unfortunately, I suspect many of the mentioned companies had not equally invested in how to properly communicate a compromise with their customers.