What has the UK’s Weir Group cyber-attack taught us?