With many companies still looking outward and only deploying protection at the perimeter, it's possible that many internal issues, between local domains, may not even have been picked up. If they were picked up then it may have been by a manual process inside the company (audit?) and not made known to the Verizon technologies deployed. Internal threats and issues tend to carry a greater possibility of reputaitonal damage, so if discovered internally they may have been hushed up?