It says the vulnerability began two years prior to acquisition but does not say that it was a one time event and the rest of the article would not make a lot of

It says the vulnerability began two years prior to acquisition but does not say that it was a one time event and the rest of the article would not make a lot of sense if that was the case.