The error: A database connected straight to the internet. This description alone points to multiple organizational failures: * Nobody did security scans from

The error: A database connected straight to the internet. This description alone points to multiple organizational failures: * Nobody did security scans from the outside * Managing the firewall failed or the firewall does not exist. * They have a culture where having production systems without passwords is acceptable. Also: They don't know who has access to their production data. * Their customers rely on a third party without regular audits We probably can go on like this for a while.