It gets worse...

It has now been revealed that a customer e-mailed PlusNet on May 5 to report the trojan to them. PlusNet kept it quiet but, according to their own forum posts today, didn't manage to flush the trojan out until May 9 - and even then they negligently failed to notify their customers of the risks they had been subjected to. In all, they said nothing for 10 days until the spam hit the fan today, forcing them to reveal all.

This company "relaunched" itself this year with "open, honest and responsive" tub-thumping. This is surely one cover-up too many and their conscious neglect of their customers may justifiably make them liable for criminal damages.