If that were the case, then who approved the acquisition? Who did due diligence on it? Suddenly letting a bunch of untrusted, poorly audited code run on your i

If that were the case, then who approved the acquisition? Who did due diligence on it? Suddenly letting a bunch of untrusted, poorly audited code run on your infrastructure is itself a massive security breach. And even that doesn't explain how data was extracted for two months with no one noticing.