Security flaws spoil Bennett's high point
In politics timing can be everything.
And for the Social Development Ministry, it is hard to think of a worse day for revelations to emerge about its security blunder.
Bad enough that it failed to pick up the warning signs, when beneficiary groups last year alerted it to security holes in its public kiosks.
It was also given a warning last week - it says it was "vague" - and failed to pick up a problem.
But it has also committed the cardinal sin of embarrassing - make that infuriating - its minister when she was soaring on a political high.
Paula Bennett said she was "mortified".
In truth she seemed somewhere between tears and anger during the joint press conference with chief executive Brendan Boyle yesterday.
She has in the past weathered her own share of criticism, including from the Human Rights Commission, for misusing private beneficiary information.
But in the past week, after the release of the White Paper on Vulnerable Children, Mrs Bennett has been lauded by most media commentators and in turn has "guaranteed" there would be no lapse in the security of information available in a new cross-agency database.
That assurance now looks hollow and the audit of her ministry - and its extension to all Government agencies - has a lot of damage to correct; especially given Families Commission and Canterbury earthquake authority data was potentially compromised too.
As a systemic failure it is far more serious than the unintentional leak of ACC data to Bronwyn Pullar - even if the blame ultimately falls on the unfortunately named "penetration" experts who tested its systems.
And when it comes to information, it doesn't get much more private or sensitive than details of medicines, suicide risks, safe houses, adoption candidates and problem children.
In the ministry's defence it did respond swiftly on Sunday when it was alerted to the open safe.
It shut down the public kiosks, instigated remedial measures and shouldered the blame without ducking for cover.
But if a head - or a contract - doesn't roll after this, then accountability means nothing.