When it was reported some of the govts sites were suddenly exposed publicly for a period ... it was more than enough time to do damage - even if nothing was compromised, it still all needs vetting properly.