This might be a "cobbler's kids shoes" issue, or just a general failure of people and process.

One of the only truisms I've found so far when dealing with breaches is that almost no one gets this right proactively. You almost have to be the victim of a breach (the more public the better) to actually rethink how your people/processes are implemented.

This seems true for the largest banks in the world, and the smallest security firms.

And it's easy to look back in hindsight and say "how could they have possibly had things set up that way?", but the truth is that this was not an opportunistic attack; if these vulnerabilities weren't present, then they'd have looked for others.

That's the problem with securing your environment, you have to get everything right, and the attacker only has to get one thing right. That being said, as with most "disasters", this was a series of cascading failures (like most airplane crashes, or oil rig explosions).

Hopefully they'll learn from this (assuming the negative fallout doesn't completely bankrupt the company).