Finally, much like the risk equation information security professionals use when deciding what defensive measures to put in place, in essence figuring out if the benefit of a protective measure exceeds its cost (in money, resource time, etc.), attackers are at least subconsciously using a similar mechanism.
FORBES: The Real Lessons Of Gawker's Security Mess