State attack = a state steals the access and keep the breach secret for as long as they can [or until they get hacked themselves]. They use it for espionage and similar purposes
Evil bad guy = all accounts and passwords are already available on blackmarket.com since Day+1 after the breach. They'll probably end up in a torrent within the next month.
Evil bad guy sponsored by a state = Well, somewhere between the two. Hopefully the state ensures they get exclusive access and non disclosure.
State attack = a state steals the access and keep the breach secret for as long as they can [or until they get hacked themselves]. They use it for espionage and similar purposes
Evil bad guy = all accounts and passwords are already available on blackmarket.com since Day+1 after the breach. They'll probably end up in a torrent within the next month.
Evil bad guy sponsored by a state = Well, somewhere between the two. Hopefully the state ensures they get exclusive access and non disclosure.