The company isn’t taking any chances despite the lack of known breaches. It’s asking G Suite administrators to change passwords, and it’s automatically resetting passwords for those who do nothing. Consumer Google accounts aren’t affected by the flawed approach.

This, along with incidents at companies like Facebook and Twitter, underscores a mounting problem with internet security: poor security approaches from the past are coming back to haunt companies that have otherwise done a lot to clean up their acts. It stresses the importance of getting security strategies right the first time around. If you don’t, there’s a real possibility of headaches years down the road.