Ask HN: Hack

I work for an organization that works in the eComm space. Hosted checkouts, lots of integrations, etc. They process millions each month for thousands of clients. Ever since I started I brought up issues with the security of this organization.For PCI audits, they move things around and turn off servers to avoid some issues. Username/Passwords are plaintext in API requests (query parameters). Login Password were hashed via SHA1. It's been migrated to argon this year. The company was hacked last month, although I'm positive it's happened multiple times in the past. Co-workers mentioned there was a hack a few years back that wasn't as bad as this. This most recent hack, they got everything. Codebase, databases, client credentials (we don't encrypt client secrets), and card numbers. They had root access to prod servers. Clients have done their own pentesting and found issues. Security wasn't a thing until this hack happened. Anyone with a brain would see the issues.It took the company about 2 weeks or so to even discover the hack had happened. The only reason the hacker was caught was because they started using the deployment pipeline to modify code/servers. I think it was because they…