Sounds like they need to spend more money on security and their "good enough" solutions aren't actually good enough.