"You see, they knew this process sucked - any reasonable person with half an idea about security did - but the internal security team alone telling management this was not cool wasn't enough to drive change. Negative media coverage, however, is something management actually listens to."
https://www.troyhunt.com/the-effectiveness-of-publicly-shaming-bad-security/