Comment by valas

It's quite possible the security firm was asked to audit their systems, but not asked (or paid) to fix them.