The more alarming part for me is that, given the scale of the breach, there was clearly some way for this CS access to (a) query and download data from a databa

The more alarming part for me is that, given the scale of the breach, there was clearly some way for this CS access to (a) query and download data from a database and (b) exfil that data in bulk. Where on earth were the controls?