When attacks spread too far: Lessons from real cyber attack case studies