> As far as unauthorized methods go - you'd patch the hole in your security to prevent them from getting through. "They gained access to our systems by convinc

> As far as unauthorized methods go - you'd patch the hole in your security to prevent them from getting through. "They gained access to our systems by convincing clients to give them administrative access to our platform." When ADP's clients giving out administration access[1] is the security hole, that is a reasonable way to patch it. The alternative is for ADP to fire their clients. [1] I have not seen ADP's TOS, but I would expect giving out the administration login to third party outfits is a violation of it.