This seems to include all their deals/financial data, the full source code to everything (including some novel things like EFI malware and possibly some Office/Flash 0days), all their mail, badges of every employee, personal screenshots/porn habits etc etc.
It's not possible to get hacked harder than this.
https://www.youtube.com/watch?v=5BrdX7VdOr0
Anyway, serves them right.
The size would need to be large enough that whoever trying to download it will have to stay a relatively long time.
How can someone be so sure what an entity is thinking or doing? Yes, it's not likely. Yes, it's risky.. but what if they were really bold?
The PR hit is a non issue if it is the case, since they can simply say what happened: "Basically, here's how to own a huge number of very sophisticated people". Make nice slides, and show them at Black Hat or something like that. It's "research".
The icing on the cake would be to present this material to the very security researchers who've been ownd. This would be a huge PR stunt since it's basically security researchers who will download the file.. And if security researchers are as confident as most people that this simply can't be a con, then all the better :)
It is still not likely, but it would be beautiful.
PS: Something like that happened at NASA many, many, years ago. There was a security breach and instead of shutting it down, the security team uploaded a ton of bogus classified files, plans, and reports to keep the guy coming and unsuspecting. Until they got him.
Isn't the question really how careless the people downloading the file are?
Is it possible to infect hardware through a virtual machine? Let's just assume it is; what's to stop someone from using a throwaway, one-way laptop? Get fresh laptop, install the tools you need, copy the files over via USB or network, disconnect the laptop and never connect it to anything ever again. What am I missing?
To transfer a lot of data (e.g. analysis results) back from the potentially infected machine, play back the data encoded as audio, record that with another computer and convert it back to binary/plain text/whatever. (There might be better ways but hey)
Sure, most people probably won't bother with any such stuff, and just stick to "only" viewing text files and images etc., but then all HT would have shown is what has been proven with email spam already: that if you can get people to treat unknown files carelessly, not to mention run executables, you can infect them.