[shadowmint]

Up-vote to the original comment because it's not stupid or impossible, just unlikely.

We can only speculate at this point.

The simplest answer is probably that one of the staff was subject to a targeted hack and a 3rd party gained external access to the CSR tools.

Possibly for an extended period of time. <-- This is the concerning part.

It's relatively unlikely an internal staff member would do something this dumb (but, not impossible. we've had this happen _here_ where I work, with credit card numbers, but obviously the person responsible was caught almost immediately).