I suspect there's a lot more successful attack that resulted in monetary loss than meets the media. When I was at a venture-funded startup back in 2011, we had just raised $15M and on a fri late afternoon, our CFO received an email that looked like it came from our bank. He clicked on it and was immediately phished. Between 4-5pm they transferred $3M out of the account in multiple chunks. The company hasn't set up alerts and the bank, which was a regional one, did not have sophisticated filters to catch them. Long story short, it quickly went Dubai, Hong Kong and London. By the time Mon comes around, some of the money has been re-tranferred again to Asia and Eastern Europe.