I wonder how the contractor did this. If it was a physical attack (unplugged a bunch of cables), then it would mean that the LSE has a rather weak SPF vulnerabl

I wonder how the contractor did this. If it was a physical attack (unplugged a bunch of cables), then it would mean that the LSE has a rather weak SPF vulnerable. If it was a software attack, it's probably even worse: it means that developers have way too much access to the production systems. In a startup, it's fine (necessary even) for devs to get access to production, but in a large financial institution, that's a huge no-no, both in terms of data protection issues and security.