sure. how many cases like these we had so far? 1, 2? and how long did they work to get commit access?
We only know how many were discovered.
Since we do not know the ratio to undiscovered this "1-2" is meaningless to assess the risk of this sort of attack.
> how many cases like these we had so far?
As with clever, careful serial killers, it's tough to count the ones we haven't caught.