I can’t believe the CTO wasn’t fired for that.

The CTO was the one holding the bonus and promotions for tech, so he just shifted the blame down when it was "investigated".

On the other hand it's not hard to believe that the CEO and the board are as sleepy as the CTO here. And the whole management team.

The worst one was when a password for an integration with the judicial system expired. They asked the DevOps to open their email and there were daily alerts for six months. The only reason they found this happened was because a few low level operators made a big thing out of it.

I don't like talking about "regulatory capture" but this is the only reason this company still exists. Easy market when there's almost no competition.