> Adam wrote in his letter. “Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission changes within the relevant period.”
tsk.
tsk.
Crazy.
Of course it looks even worse now that we know they didn't do anything to help customers.
But telling your client to sweep something like this under the rug isn’t exactly great advice.
Legal made the right decision. You clean up the internals, close the backdoors, and then you notify/refresh user credentials.