Stories like this remind me of something an insurance executive once said in response to a suggestion to reduce his customers' risks: "I'm not in the business of reducing risk; I'm in the business of pricing it." A few billion well-placed dollars could easily smoke out the turds who perpetrate these costly attacks. But the victims don't have a way to organize the search, and the companies getting paid to defend against the attacks don't really want them to stop.