How much is this costing them ?
How much more would it have cost to have done a proper job and secured their systems in the first place?
I suspect that some bean counter decided that the cost of good security was not worth it -- after all "it will not result in any extra business - will it ?"
Blame will probably be given to some lowly techie who was given neither the time nor the money to do it properly. If someone higher up the management chain is fingered they will get a nice golden parachute and told to keep quiet.