The question is.... Why has this been swept under the carpet for months?
It wasn't. They notified folks whose accounts were compromised and dealt with it. The only new thing is that Reuters decided to (again) make it 'news'. Must be a slow week for them?