> But it turns out that the engineer had a big part to play in this major failure as well.

> "For reference, the version that addressed this exploit was roughly 75 versions ago," a LastPass spokesperson said.

Quite the game of blame deflection going on.

Whether or not the employee was running an outdated version of Plex or every bit of malware known to man on their personal computer has no bearing on the company's security breach. How was the attacker able to cross the corporate security boundary? Did the employee have access to company/customer data from their personal computer? Was this in breach of company policy, or is this generally allowed? If the former, why was this access not monitored and flagged? Answers to all of these are conveniently skipped in favor of "see it was an old version of Plex, case closed".