We redacted a bit to protect the innocent, but anyone can find it on Google.
So what is going on? Did they got hacked somehow? We don't think so… By looking at the disclosed data dump, it looks like one of their developers make a little mistake:
Can you see it above? Instead of starting the PHP file with a "<php", he started with "i?php" and somehow it went to production…. Guess what happened? Instead of executing the PHP code, the web server would display the source code for everyone to see… Including passwords, API keys, server names and anything that was specified in there.
What can we learn from this ? One, is that the developer uses VI/VIM. Two, test your code before going to production. Three, never rely on obscutiry alone for your security