The question for investors is what do we do with our positions? Reduce weighting proactively to migitate against the emerging/latent risks? Or continue to hold and do nothing until further information is revaled, by which time the damage (if any) will already be done, especially in such an illiquid name?

Shares are holding up reasonably well so far...

[Held IRL]

@thunderhead IMO way too early to make any moves. Patience while the investigation takes the time it needs to be thorough and identify all affected systems + data is required. I'll be sitting on my hands and hoping that in the fullness of time, some thorough + transparent reporting of the incident is released.

I also disagree with @Valueinvestor0909in that there is still the possibility of "a win" emerging if it turns out their security practices are both shown to be best practice and the details of the "attack" are able to be fully established + shown to have negligible impact (e.g. if they can identify the attack vector, had sufficient auditing in place to trace every move, and are confident systems/data of low importance were accessed). I'll concede that I'm not expecting such a win to materialise though ;)