There are multiple problems with this, from both a regulatory and internal control perspective: * Regarding testing internal changes - banks maintain vast test

There are multiple problems with this, from both a regulatory and internal control perspective: * Regarding testing internal changes - banks maintain vast test databases (admittedly full of customers called Ronald McDonald) covering almost every scenario. Testing goes far beyond unit testing and smoke testing, but dedicated teams of system integration and user acceptance testers. This 'test' was not a 'test' by any measure of internal policy. * Contractors should not ordinarily have access to customer data. Regulators across jurisdictions make this clear. They can, but an excruciating approval process is necessary. * Contractors having external email access to anything but whitelisted domains is unusual, and worth raising an eyebrow at. * Why is the email address being typed in? I've never worked at Goldman but expect like almost every other bank in the world they use Exchange, which typically allows typing in [Lastname], [Firstname} with a list of people to then select (Jones, David1; Jones, David2; Jones, David3; etc). * Why aren't attachments required to be encrypted, especially to external domains? This is an automated feature in Exchange. I'm pretty familiar with all the duck tape that gets used in daily banking. So are regulators, who take a dim view of VBA being used as glue to tie together 1000s of internal systems, but often turn a blind eye. But this is not a case of duck tape, it is institutionalised failings at several levels. So the response is not surprising, Goldman have to show they take this seriously, despite so many internal failings, and shirk a bit off on 'external contractors' too.