The telecoms giant says cyber criminals mounted a sophisticated attack against it. The government claims the company "effectively left the window open" for it to be taken. Are others doing the same? And have national security laws forced businesses to harvest too much data?