Yup. They fucked up pretty bad. How many places do you think are worse than them?
Probably all of them because no one loses money for bad InfoSec practices.