Doh! "In July 2012, more than six months earlier, a malicious third-party gained access to their network using an SQL injection attack."

Why is this kind of attack even possible against a so called 'security' firm.