Who knows when the flaw in their process was introduced? Perhaps it passed all the audits and tests, but got misconfigured later. There's no doubt or question

Who knows when the flaw in their process was introduced? Perhaps it passed all the audits and tests, but got misconfigured later. There's no doubt or question that the process was flawed (in that the tools were silently failing and that a single human failure could disrupt their security). The point is, that even with solid processes and procedures, it is impossible to have perfect security. No doubt they (and every other company) will have a much higher focus on security going forward, but at the time they thought they were adequately protected. Their policies were sound, but their execution was flawed, and they got burned.