It's unbelievable to me that they waited over 3 months from when they became aware of this vulnerability until disclosing to effected organizations.