Attribution for these attacks is notoriously difficult. Hackers operating on behalf of states, grey areas in terms of difficulty in figuring out attribution as to who exactly has launched an attack, is a problem that characterizes the cyber realm.
I'm all about understanding that the threat is going to become more severe and that we need to build protections against these threats. But at the end of the day, my working assumption is that an effective, large-scale attack will someday succeed, and so building resilience, building the ability to get the power grid, the natural gas system, or other critical infrastructure back up and running, is imperative.