I don't understand why there wasn't an air gap between this accounting desktop and the production key servers. The Excel 0-day vector is interesting, but what this tells me is that even without that, all those secureid tokens could also have been hacked by one malicious janitor.