http://nuclearcdboxafziza4mgohcwhzfjiyg6zeslnry33pepsgtur2wyeyd.onion/social/2.html
If a business puts in the time and money to build defenses, another doesn't, and neither gets attacked, one has wasted money and is more likely to fold. States can intervene to try and force security through regulation, and there are other exceptions, but the trend remains. So most businesses are pretty soft on security once you're in the door, and filled with these single points of failure, like a router or server or service payment.