It's not about the careless programmer IMO. It's that there was nothing in place to make sure the data was secure. Or if there was, it wasn't effective.