So they probably have a request logger that logs request headers, and they accidently were logging credentials from those headers is probably what happened. Thi

So they probably have a request logger that logs request headers, and they accidently were logging credentials from those headers is probably what happened. This has hit basically every large web service at some point. Crazy this never came up in an earlier internal security audit, but not surprising it occurred in the first place.