These days, the Chinese and Russians can get whatever they want from companies like Equifax without leaving the comfort of their own homes or dealing with messy human interactions. Either one of them can, and most likely did, hack Equifax at will.

I would be surprised if a large company with very good security practices could resist them indefinitely, Equifax wasn't going to hold them off.

The difference between state actors and regular thieves is the state actors don't want anyone to know about it. Sony got wrecked by North Korea because they wanted them to feel the pain. That could happen at almost any company, just the state actors want a long-term strategic advantage not a short-term one.

The ubiquity of technology in all aspects of our society makes us extremely vulnerable to losing a digital war. We have so much more to lose, and so much more surface area vulnerable to attack. Seriously, North Korea was able to assert their will on us just to (successfully) keep a movie from being released to theaters.