External cyber-attack confirmed • 25%

Internal leak confirmed • 25%

Mixed factors (both external and internal) • 25%

Inconclusive results • 25%

Data fully recovered • 50%

Data not recovered • 50%

Hacking group publicly identified • 50%

Hacking group remains unidentified • 50%

Confirmed external attack by a state actor • 25%

Confirmed external attack by non-state actors • 25%

Internal security lapse • 25%

Inconclusive findings • 25%

Minimal data compromised • 33%

Moderate data compromised • 33%

Extensive data compromised • 33%

Diplomatic talks • 33%

Sanctions • 33%

No significant action • 34%

Yes • 50%

No • 50%

Financial compensation • 25%

Identity protection services • 25%

Enhanced cybersecurity measures • 25%

Public acknowledgement and apology • 25%

Yes • 50%

No • 50%

Enhanced cybersecurity measures • 33%

Increased contractor oversight • 33%

Changes in personnel handling sensitive data • 34%

Contractor held legally accountable • 50%

Contractor not held legally accountable • 50%

Yes • 50%

No • 50%