> According to the paper, the vendor responsible stated that it "has followed the accepted industry standard and it is that standard which does not include security."

Clearly, the 'vendor' lacks a PR team.