This highlights more than ever that whatever customer data your employees have access to, you need to log every single access to it, and have automatic audits- who should be accessing what? What accesses are surprising?

Seems like something one could build a SaaS business around- send them reports that <user> accessed <fields> about <customer ID> on <date>, along with a copy of attributes and roles about each user. Service could offer deep dives, querying, reporting, along with ML or rule-based flagging to say "That seems odd".

If Twitter can't build the infrastructure needed to do that, I can't imagine how few small companies can do it themselves either.