This was an issue caused by a negligent company failing to keep their devices secure. For me the solution to this is not just to rely on another potentially-also-negligent company. In my opinion on-prem+off-prem, or multiple off-prem solutions are necessary for anything of actual value.