Not to say that your vendors have to be perfect, but if they have a known credential leak for 18 months that's pretty negligent.