An outsider might suspect that this occurred because ARCBS is the sort of organisation that simply doesn't have the speciality/budget/staff required to manage data security properly, but this isn't the case by any means. My retrospective impression is that they had capable teams covering data warehousing, data security policies, network security, etc. All of my experience in the field tells me that they were better protected than the vast majority of organisations of their size.
This event has solidified some of my more apocalyptic thoughts w.r.t. info-sec. Namely, that a guarantee of secure data is essentially out of reach for almost any organisation of any size. Partly this is due to increased connectivity of networks, but equally it is due to better tooling and analytics staff making thorough organisation of customer data the norm.
The cause of this problem is the hoarding of knowledge, as Zhuang Zhou realised two and a half thousand years ago:
> In taking precautions against thieves who cut open satchels, search bags, and break open boxes, people are sure to cord and fasten them well, and to employ strong bonds and clasps; and in this they are ordinarily said to show their wisdom. When a great thief comes, however, he shoulders the box, lifts up the satchel, carries off the bag, and runs away with them, afraid only that the cords, bonds, and clasps may not be secure; and in this case what was called the wisdom (of the owners) proves to be nothing but a collecting of the things for the great thief.