It's unfortunate the IT had to find out the hard way just how broken their site security was. It's worse that this isn't the only site out there that is that broken. It's common, they just happened to publicize their lack of knowledge of security and then users went poking around. "Oh hey, SQLi works." and that's that...

Here's hoping they manage to give proper disclosure to their customers/users (hah...doubtful).