I really do not understand how the origin country of the attack can be so quickly identified, and that based on that it gets attributed to the government of said country. The source IP of attack usually tells you absolutely nothing about the origin, it's typically a hacked server or a desktop which can be in China or in France just the same.
I also heard on the news the so called "security experts" claim that certain "patterns" in the attack allow them to attribute it to a specific group of hackers. Anyone who's dealt with security for real knows that there are no patters (just like there really are no hacker groups).
In 99.9% of these cases the best you can do is identify and close the hole they used and any others they've left behind, assess the damages and notify the affected people. You will never find who did it, from where and why.
I also heard on the news the so called "security experts" claim that certain "patterns" in the attack allow them to attribute it to a specific group of hackers. Anyone who's dealt with security for real knows that there are no patters (just like there really are no hacker groups).
In 99.9% of these cases the best you can do is identify and close the hole they used and any others they've left behind, assess the damages and notify the affected people. You will never find who did it, from where and why.