My thoughts exactly, though it seems the incident happened a few years ago when the mentality of "move fast and break things" mentality was much more acceptable.

I'd be very concerned if there still aren't processes and technical barriers to prevent the majority employees from accessing user data. IP address, phone number, etc. should require top-level authorization to access - not something an engineer or even marketing/sales person can just look up.