I think your comment can be easily interpreted as a knee-jerk criticism of American regulatory environment en mass. At best this is a straw-man, and at worse it's a hyperbolic jump to assumptions about the attack vector, existing regulations, and how you believe them to be insufficient.

It's too early to know anything for sure about the breach and certainly holding pre-made assumptions prevents a more level headed, careful analysis of the facts.

That being said, I agree that on the face of it, this is pretty damning evidence that regulations were either not in place, or were not verified to an acceptable level.