Perhaps this is a trivial point, but bragging about all their controls and audits and whatnot while reporting this sort of failure seems to call into question the value of all those controls and audits and whatnot. If any procedure in that company should be audited until it's airtight, then the process of securely generating, storing, and using keys should be. I doubt a more in-depth analysis will be forthcoming, but it would be nice to find out not only why they're not doing their main thing in the proper fashion but also why it took an actual breach to find that out.