pretty sure the responsibility of announcing that sort of thing goes to chief risk officer, or legal -- not usually technology. though clearly they failed in so

pretty sure the responsibility of announcing that sort of thing goes to chief risk officer, or legal -- not usually technology. though clearly they failed in some way (security training, sdlc process, m&a due-diligence, or whatever)