Surely you have some reasonability to vet your supply chain. Not to say that your vendors have to be perfect, but if they have a known credential leak for 18 m

Surely you have some reasonability to vet your supply chain. Not to say that your vendors have to be perfect, but if they have a known credential leak for 18 months that's pretty negligent.