Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites.