A recent article on DefenseOne has suggested that companies who are breached by attributable actors can ethically and legally hack back in retaliation, citing a 1984 lawsuit between the United States and Nicaragua. Based upon a skirmish in an unclaimed area of Antarctica, it was determined that no one would be held liable over ‘frontier disputes’, since no one has territorial claim to the area.
Apparently, since cyberconflicts happen in terra incognita, as long as no physical property is destroyed, retaliation for breaches are legal. I suppose that any data is fair game, but if you start bricking devices or blowing up gas pipelines (like in 1982), you’re gonna have a bad time.