https://www.techradar.com/news/open-source-its-not-the-code-its-people

The need for open source security management became front-page news last year thanks to a major data breach at one of the world’s largest credit reporting agencies, Equifax. 

Equifax maintains a vast amount of sensitive personal and financial information for residents of North America and the United Kingdom. It also used Apache Struts in its online disputes portal web application, and for reasons still unclear, a vulnerable version of Struts in that portal was not fixed, even though Equifax was aware of the need to patch.