You would be surprised the unrestrained access given to sales and support employees at most small SAAS companies.

Exactly. I'm not entirely surprised to see a company with a history of unprofessionalism and poor security policies, hacked.