I wouldn’t even pin it on IT. I’d be willing to bet there’s some poor IT person, or perhaps a lot of them, cleaning up this mess who have been begging management to beef up info sec for a long time.