$22-million???!!!
I'm guessing they'll recoup through some sort of insurance for this type of thing. But honestly, what insurer would pay out for that? It's like they didn't even try to secure their systems.
I work for a cyber insurer (who are trying to reduce the risk of compromise, alongside transferring some of the risk via insurance) - providing they’ve not been misleading in their application, we take the risk as we find it and can’t just not pay because of poor cyber controls.
Though given the size of involved parties just about anything can be waived (especially with legal threat of an agency losing power over a court striking it down).