Patches published months before the massive hack began were apparently not applied before the hack.