As others have pointed out, you can never know who's next. Unless there are some obvious holes in security, determining the next victim is close to impossible. That's why implementing measures preventing attack is one side of the coin, other being nullifying the occurring damage and mitigating any potential risk, patch some holes, etc.

EXMO handled situation pretty well, as far as I can see. Cloudfare is a standard protection measure in cases like these.