This is really terrible, I feel deeply for the father's predicament.

This ought to be a salient lesson: never store card details online despite the convenience. Further, as I do, use only a debit card for online purchases with the available credit only marginally more that for one's immediate purchase. It's also an excellent policy in case of being hacked.

Companies that allow employees to use cards with essentially unfettered credit have to take a large amount of the blame in circumstances such as this. There's no reason other than bad policy or irregular monitoring of expenses to allow expenses of this magnitude to build up. The company's financial policies need drastic overhaul.