Always assume the worst, I gaurentee it is usually that bad in reality. Companies absolutely hate spending money on IT and security is always an after thought. API logs for the production systems that contain your full legal name, DOB, SSN, and home address? Yea wide open and accessible by anyone. Production databases with employee SSN, address, salary information? Same thing, look up how much the worthless management is making and cry.

Booz Allen just got shit on because of the dude they hired who specifically sought out consulting for the IRS so he could steal Trumps IRS records.

https://home.treasury.gov/news/press-releases/sb0371

https://en.wikipedia.org/wiki/Charles_E._Littlejohn

Not that different from all the innocents the US gov has murdered. We literally just watched ICE gun down two citizens in Minnesota and per usual nothing will happen or change.