Man, if people who don't know what they're doing are this successful, imagine what it means about people who are. And how any laws we make about computer security are just security theater.
The mid-risk category are the real professionals; they leave no trace, you never hear about them, you never know they were on your system, they just take your data and sell it.
The highest-risk category is true information warfare, targeted attacks by other governments and large entities. As the previous replier said, just look at Stuxnet. You don't have to be a government for this to be a real threat. Imagine if Nintendo had compromised Sony's servers, and somehow loaded corrupt firmware onto the Playstation update system...
These threats are real and constant, and anyone with sensitive data needs to be aware of them. Simply firing up iptables and disabling root SSH isn't sufficient - you need to be aware of the intricacies of your system on a day-to-day basis.
Computers and especially networks are just fundamentally insecure for the purposes of high-value information.
This is the same reason why internet voting will never be a good idea.
http://www.youtube.com/watch?v=_GjmRwfkRXY
Electronic and Internet Voting (The Threat of Internet Voting in Public Elections)
It goes into all sorts of electoral fraud, the finer points of designing elections from a hacker perspective, the diebold hacks, and that awful rails app that those students (?) wrote in the hopes of using it in some US local elections a while back.
In brief, that system isn't safe because someone can obtain your reciept and therefore your voting rights from you by coercion/incentives. Votes should never be verifiable, because then they can be bought. Vote reciepts would be pretty valuable...
It's nearly legal to buy votes anyway, but they just call it advertising.
That's one thing a lot of non-experts don't appreciate about these sorts of attacks. They are not terribly sophisticated, nor are they terribly malicious. This is why I put so much blame on Sony and Gizmodo, because they're not being attacked by some elite team of super hackers with an elaborate plot to destroy the company. Rather, they're being attacked by bored teens who are using crude techniques that no public facing website should be vulnerable to in 2011 and they are just dumping what data they gain access to on the internet. Compared to the sort of mischief a talented and dedicated hacker could achieve this is nothing.