Turning the other cheek is an OK strategy when the damages are not terribly high and the political and economic costs of any reaction would be worse than that of the attacks. In fact, improving defensive security and not responding to cyber-warfare except in cases that imminently endanger human lives or defense capabilities would probably be the sounder policy. That said, that's far from what the U.S. government is doing, the U.S. government engages in espionage and arguable cyber-warfare against nations it's not in conflict with (including China) with alarming regularity. The Snowden leaks give us an idea of how a fraction of those operations looked more than 6 years ago...

If it were me, I'd just issue a formal letter thanking the Chinese government and their people for spending their own taxpayer's money pen-testing U.S. infrastructure and ensuring security best practices are followed ;p (yes, I am being tongue-in-cheek, speaking of cheeks...)

Exchange China with NSA and read your post again.

Done. Tepid feeling of unease was experienced that could be also be attributable to the grocery store sushi I had for lunch. To help put your mind at rest, USGOV bureaucrats oscillate across an ass-covering wave of incident driven threat detection peaks, and valleys of privacy right restrictions on their abilities. China, singling out just one state actor, operates unmodulated. There is a difference of level, accountability and transparency that makes your comparison invalid.