Oof that's rough. No doubt due to a lack in knowledge and funding in IT coupled with a breakdown in process by accounts. Hopefully they have cyber insurance because they are going to need it to make sure attackers haven't traversed the network and are lingering.
I bet you IT get everything they ask for now. CFO won't bat an eyelid if it has #security in the exec summary!
