SOX. SOX mandates that you have reasonable controls to secure financial information and it appears they didn't. Every SOX audit I've been through has a IT security portion.