Seems like a governance and compliance issue. They either didn't have or failed to comply with their corporate AI Security Policy. Also, their DR strategy seems lacking if they didn't have any recovery options plus didn't test the procedure once in a while. They probably deserved what they got.