I would hope it's not the authentication team's systems that are logging payloads with passwords.. they should definitely know better. Presumably it happened some infrastructure component owned by another team.