If all of the details in this post are to be believed, the vendor is repugnantly negligent for anything resembling customer respect, security and data privacy.

This company cannot be helped. They cannot be saved through knowledge.

See ya.

+1

Yes, even when you know what you're doing security incidents dan happen. And in those cases, your response to a vulnerable matters most.

The point is there are so many dumb mistakes and worrying design flaws that neglect and incompetence seems ample. Most likely they simply don't grasp what they're doing