I will say that of all the hacks we've seen - and we've seen...

I will say that of all the hacks we've seen - and we've seen hundreds and hundreds of these - had the third-party been in compliance (with association rules), they probably wouldn't have been hacked,