Internal negligence • 25%

Third-party vendor fault • 25%

External hacking group • 25%

Unknown/undetermined • 25%

External cyber-attack confirmed • 25%

Internal leak confirmed • 25%

Mixed factors (both external and internal) • 25%

Inconclusive results • 25%

Confirmed external attack by a state actor • 25%

Confirmed external attack by non-state actors • 25%

Internal security lapse • 25%

Inconclusive findings • 25%

Hacker Arrested • 25%

Hacker Remains At Large • 25%

Funds Fully Recovered • 25%

Partial Fund Recovery • 25%

UnitedHealth found at fault • 33%

UnitedHealth partially at fault • 33%

UnitedHealth not at fault • 33%

Hackers identified and apprehended • 25%

Hackers identified but not apprehended • 25%

Hackers not identified • 25%

Investigation inconclusive • 25%

Full responsibility acknowledged by Post Office • 33%

Shared responsibility with IT providers • 33%

Minimal responsibility acknowledged • 34%

No significant changes • 33%

Moderate improvements • 33%

Significant overhaul • 33%

Investigation completed • 25%

Investigation extended • 25%

Investigation halted • 25%

Investigation results inconclusive • 25%

Regulatory failure identified • 25%

Individual accountability emphasized • 25%

Recommendations for both regulatory and enforcement improvements • 25%

No major findings or changes recommended • 25%

No action taken • 25%

Warning issued • 25%

Fine imposed • 25%

Mandatory recall ordered • 25%

Increase in cybersecurity investments • 33%

Public reassurance of existing security measures • 33%

No significant response • 34%