So incompetent they couldn't access an unsecured Amazon S3 bucket that was known to be insecure for some time? It sounds to me like GiveSendGo is simply incompetent with respect to security and some unskilled "hacker" took advantage of their incompetence.