If the company claims to have business-critical resources, then it should also be sentenced for not protecting them enough. What&#x27;s happening here is weak password-based security, non-deactivated credentials of a former employee, and an attempt to fund the security firm from the penalties on the hackers.