Pretty straightforward systemic failure -- Dev team, I would guess, assumed full disk encryption would cover it, and nobody checked the assumptions. Or to rephrase: it was fucking obviously encrypted dude.