I'd be hesitant to call out one person. A process failed. Where were the code reviews, design sessions, pentesters, QA, UAT, automated tests?
in this case, every single individual in the chain ( from backend dev to frontend dev to tester to enduser) are able to see that something's very wrong. Which means none of those people are competent. Not any of them.
I've set foot in ~20 computing science classes, out of a ~134 credit-hour degree, and only one optional class ever mentioned that this sort of thing would be a bad idea.
It also didn't actually rigorously teach best practices, only mentioned a laundry list of security blunders that you probably want to avoid, without proscribing any solutions. We also were not tested on this.
And this degree wasn't in some middle-of-nowhere community college.
Also, as anyone who has ever set foot in a computer science class ought to know, these kinds of failures aren't the fault of any one person. One person may be undereducated, ignorant, lazy, stupid, or just in a hurry to ship. It's the entire organization's responsibility to provide checks and balances that prevent this sort of thing from hitting production.
And that is why applications dealing with sensitive data are still being produced by people with no clue about security. Because there are never any consequences for leaking sensitive data, there is zero incentive for companies to spend the money on hiring competent developers.
The level of incompetence required to commit such a fault is beyond what i would expect from any "third world" country. So, the fact that it happened in a country that advertize itself as a startup nation, and is exposed to one of the highest level of terrorist threat in the world is beyond my comprehension.
If i were israeli i would recognize this event as one of the most damaging one of the last decade in term of public image. Israel has a huge flourishing business related to cybersecurity, mostly based on the reputation the country has for having the best specialists. If you know anything about business, you know how much image is important, and how this issue should be treated as a PR disaster for the whole country.