It happens. This is the type of revelation where heads roll and a scapegoat is very useful for the CSO, general liability of the company and PR.