CSA supplier knew of IT flaws