The time and resources involved in finding, prosecuting, and convicting a hacker is very large. The damage of a hack is potentially immediate and also requires a lot of time and resources to mitigate. Time and resources are constrained; the correct move is to repair what can be repaired and harden security where possible. Resources are expended to track down criminals - but how would you go after a foreigner working either for their military or a criminal mafia, for example?