When the CTO decided that he wouldn’t do anything about my work getting sabotaged by a busy-body from another department. As soon as I had signed a new contract, I handed in my notice and told our head of HR (who was very understanding but ultimately powerless) all the reasons why I quit. They didn‘t even try to make me a better offer. I don‘t think I did anything wrong, in fact the CTO had awarded me the company’s "tech employee of the year" award just 3 months earlier.

Middle of the road: pay your employees in ping pong tables, increase monthly ping pong table quota.

You didn't sell the recovery tool, you sold the warm and fuzzy feeling that somebody was looking out for them.

Address, phone number, credit card and all.

Oh wow. As someone who used to work in Fintech and who built a PCI-DSS compliant system got it successfully certified, it would be a shame if somebody reported that company for violations that could get them to lose their PCI-DSS certification. I mean, do they just bribe their PCI-DSS auditor to overlook this, or have they just managed to hide this blatant issue so far?

Sounds like you escaped a violent theocratic cult.