As soon as you start linking credit card, address, and other store-related information to an online account, it ceases to be a “multiplayer account” and becomes a “store account”. There’s not a single online service where that doesn’t hold true. The store was the only service that was truely affected on the long term and in reality it’s been vulnerable since it was first brought online.
Regardless, they could have simply released a version number only update that made everyone reset their passwords. You know, similar to what they did after it came back up.
The rest of the security could have been fixed by firing their security team, the entirety of it, and contracting with someone for the short-term while they replaced their internal team. All the temporary team had to do was install actual software and hardware firewalls, you know, the kind that the rest of the business world uses. I haven’t heard of them actually firing or hiring anyone, I guess the Japanese weren’t too fond of Einstein: “You cannot solve a problem with the same mind that created it.”
If WCU can manage to secure their network using off-brand hardware and an all-talk, no-action CISSP I have no sympathy for any company that gets hacked.