(disclaimer: i used to work in Corp. IT and worked with security issues)

these companies have ignored security for years and don't care because good IT costs mone (which cuts profits). for years, people have spoken up about this stuff and been ignored. it's sad but, at this point we need laws to punish companies that ignore security, particularly simple things such as keeping patches up to date. severe fines and pay outs to customers and staff who are at risk now of identity theft and all the rest. 😇