>Maybe if you house sensitive information you should have a person or multiple people enforce security across your organization?

They probably didn't care, and should suffer consequences as a result.

This looks like a really small company who contracted this stuff out to a WordPress shop. There's almost no tech employees or positions on job boards for them.