This tweet explains how they might have gotten in (i.e. unpatched ssh servers) https://twitter.com/damienmiller/status/1427195852011937797?...
"Audit Flags: NO_PCI NO_SOX"
Ouch.
Also, "IBM 9117-MMD" would be a POWER7+ server that was EOL in December of 2020.
Auditors can exclude these systems? WTF
"Audit" in this case is the more generic term relating to the company responsibilities to audit systems with sensitive data.
They are saying the system is not subject to governance type controls for either PCI or Sarbanes-Oxley. Which is ironic given what was leaked out of it. And yeah, that probably means they told cybersecurity auditors this system wasn't subject to rules associated with PCI and/or Sarbox.
https://www.telekom.com/en/corporate-responsibility/data-pro...
Most such issues are business-as-usual there.