I LOL'ed so big just reading the headline. It is absolutely terrible, but I have seen this before with big companies that should know better. About 6 years ag

I LOL'ed so big just reading the headline. It is absolutely terrible, but I have seen this before with big companies that should know better. About 6 years ago I was working on a project for The Wall Street Journal (yeah; that WSJ) in which all customer data was being stored in the DB in plain text then exported nightly to an Excel report and emailed unencrypted to client managers so they could review daily sales. On numerous occasions I told them that was extremely risky and that we were violating PCI compliance and opening the companies to huge potential fines in addition to just putting customers information at risk. Every time I brought this up I was told there wasn't time to fix the application and that the client managers thought it was too difficult to deal with encrypted files so just leave everything the way it was. Eventually they got busted on a PCI compliance audit and started using PGP to encrypt the files sent via email; but by the time I left they still were not encrypting the backend data or actually maintaining PCI compliance. Extremely sad; but this happens all the time.