the real question is why one vuln in their web framework allowed unfettered access to basically all of their data The hack involved "primarily names, Social Se

the real question is why one vuln in their web framework allowed unfettered access to basically all of their data The hack involved "primarily names, Social Security numbers, birth dates, addresses and, in some instances, driver's license numbers", that's a very limited subset of the data they hold on people. I'm not defending them, but this was not "basically all of their data".