C'mon
"While it’s positive to see that staff at ULCC have got the system back up and running, over four hours of ‘complete shutdown’ is not an acceptable time-period in most businesses cases."
DDoS are not that easy a thing to defend against, even some of the biggest names have been wiped out, but this is not exactly a obvious target so being out for 4 hours is no major surprise.
Yes you can take precautions, but it is a risk vs cost basis.