Troy Hunt wrote about this a few years ago, with the pithy headline '“We take security seriously”, otherwise known as “We didn’t take it seriously enough”'

https://www.troyhunt.com/we-take-security-seriously-otherwis...