Based on the wording of the statement it seems likely they had no usable backup solution at all. Offsite or otherwise. Even a 24 hour daily backup should have provided some data. Sounds like a classic case of neglect to me. They probably had a solution in place but didn't verify it was actually working.

I mean this could count for criminal negligence. I wish they would release more info on how the failure happened and why the backups aren't working.

Seems like a big assumption since we don't know any details. Perhaps a malicious sysadmin?

Apparently they botched an upgrade of their Oracle SAN.