Seems like all a bad actor has to do to gain access is to compromise one of the partner companies that has access.