Their response, which was to not disclose the breach? Or their late response, which was a vague email you might need to change your credentials? Or the fact tha

Their response, which was to not disclose the breach? Or their late response, which was a vague email you might need to change your credentials? Or the fact that their cloud environment was a joke run by a one man show? It's like Okta. Of course it's hard to protect against an insider ( although Ubiquti didn't really try), but that's not an excuse to screw up the disclosure.