I can fully see how this could happen. Too many companies don't understand the value of keys like this, and won't until they have a similar situation.

I wonder how exactly the criminals came to have them in the first place, but would be willing to bet it was ultimately incompetence by someone at Nokia.