I don't think they were storing them in plain text, but on a login request it would log the request body without properly censoring the password. The password could still be hashed when it was actually put into the database.