All 39 observed attempts to publish packages to our NuGet feeds were rejected.

The observed attempts to access other customers' data or restricted resources were rejected. Tens of thousands of requests targeting our core systems did not result in unauthorised access.

Did I just read about good security practices? It certainly feels like a nice change compared to catastrophic or non-transparent reports we often see from other parties.

That they can trace, analyze, and recognize the attack activities and consequences stood out to me as well. (It's a topic/target in my work environment too.)