The entire story is the cost of not recognizing you're an engineering firm that handles money, versus a bank that bolts on IT at the lowest cost possible.
Citi learned the hard way, which is good, as it's the only way for such an org to learn.
Citi learned the hard way, which is good, as it's the only way for such an org to learn.
Do we have evidence that they actually learned anything from this?
I can't imagine it's any different in Citibank.
Having worked for companies the size of small startups up through megacorps, my experience has been that megacorps can be unfathomably foolish in these kinds of things.
I'd expect Citibank to be less likely to learn (and apply) the right lessons from this experience, than a small or medium-sized business would.
If Revlon defaults on the loan entirely, then the money evaporates.