It is massive, egregious neglect of basic, foundational cybersecurity principles. Least privilege and access control are harped on in the most elementary teachings. I don't know if contracting offshore for handling of PII is the industry norm, but it seems very risky to give unfettered access to people who aren't directly employed. Seems they got too big for their britches, as my grandma would say. It will be interesting to see how they fare after this.