The client only had the decryption key in memory (the curl part of their story). Where it breaks down is assuming only the web server that is compromised has a

The client only had the decryption key in memory (the curl part of their story). Where it breaks down is assuming only the web server that is compromised has access to the database.