It doesn't matter — even if it started entirely as an accident— the vendor's failure to promptly address it, and the fact that that failure is a systematic property of their operation, puts them into the outrageous category.

It's like when you're on hold for 20minutes hearing recordings about long wait timed due to "high call volume".

No, it is not high call volume, it is the damn company systematically understaffing the call center and overloading their workers to extract more money and externalize more costs onto their customers.

We should avoid doing business with them if possible.

I agree it's ridiculous that the vendor has gone radio silent -- in any other industry this would be deadly behavior.

But I've been in weird, regulatory spots before where communication is forbidden pending investigation or an audit. If you get flagged for money laundering, they're not allowed to say "hey we flagged you for money laundering", and possibly not even allowed to say "we're looking into it".