It is massive, egregious neglect of basic, foundational cybersecurity principles. Least privilege and access control are harped on in the most elementary teachings. I don't know if contracting offshore for handling of PII is the industry norm, but it seems very risky to give unfettered access to people who aren't directly employed. Seems they got too big for their britches, as my grandma would say. It will be interesting to see how they fare after this.
Discussion
Yeah, though in my limited experience with offshore teams (Indian), they get treated like nuclear spies (frosted glass, no phones in or computers out) over less sensitive data. But that could be because they were somewhat skilled/professional grade hires. Not so sure how much that would hold for a company called "TaskUs" lol. Sounds like a new uber service (oh yeah, tastes it is what I'm thinking of ha)