Anyone who ordered Steam hardware in the last ~3 months in Europe just had their names, address, phone number and email stolen
(sh.itjust.works)
You still don't know how much they spend and how the attack was done. Often security isn't even a matter of money, but knowledge and trust of your own teammates. Maybe you are right after all, but my point is, we don't know YET.