I never let my energy devices onto the Internet. The house controller - a Raspberry Pi - is allowed when I wire it to the router using an ethernet cable.

If I worjed at the company which did the cyberattack, I would fear both civil liability and prosecution.