@
HootyTheNightOwl I think "we" - nearly everywhere - have sleep-walked into the hacking problem, by two routes.
Firstly the near-monopoly of one company's software, and the need for universality to make the Internet work, must be a big advantages to attackers with the appropriate IT skill.
Secondly by using the Internet so much it lays what should be private systems open to attack even with every attempt to use anti-virus software.
Recently I encountered a health survey in which the chain seems to contains a link by post, breaking the all-digital sequence. I wonder if major organisations will go back to using isolated systems and postal or carried communications to protect sensitive information - though with care because physical media (paper or digital) carried by individuals can be compromised by theft or accidental loss. Even if the thief does not know what his loot contains. It has happened!
I think the most recent attack on NHS information was not on NHS property directly but on a contract laboratory. If so why were the samples not simply designated by random codes meaning only the individual sample identity? The patients' and doctors' details would be kept at the commissioning hospital, on computers maybe, but those behind isolating servers. Servers further, programmed to spot any incoming attack, disable and block it, and report its disabled source and programme code to the relevant authorities.
Nuclear power-plants normally do have very strong security; though any fences and guards can be attacked physically of course. Besides, no amount of compound-building will protect the buildings from missiles or drones.