All reasonable if the company wasn't 8 years old, had 2500 employees and a turn-over of 600 million. They invested clearly near nothing in security over the last years. The extra scrutiny showed that, but it didn't CAUSE it.