Let's say you're a state that the US is not on especially friendly terms with. A state which has a record of cyber-attacks against American servers. China, perhaps. Maybe Russia.
Now, you've learned via testimony in front of a congressional hearing of all places that a website that millions upon millions of American subjects, sorry..., citizens are required by law to to enter all sorts of personal information into is effectively unsecured.
What would you do?