My money is on they put a database password or equivalent credential in whatever agent was running on the employee workstations and somebody found it.

“We will only re-enable MCI when we are confident in the effectiveness of our data protection controls,” Kasriel said.

This should have been an obvious concern from the start. All the data would go to Meta, who are known to be the most reliable, privacy-focused data stewards in the world.

Days without Meta violating basic principles of honesty, dignity, and decency: zero.
Days without Meta reverting harmful decisions only because people outraged at it: zero.

(And no, neither counter is broken. They don’t reach one… because.)

There’s really a competition for which billionaire is the most out of touch with humanity. They keep outdoing each other.