Interesting note: from the sounds of it, this was done by a contractor brought in at some point.

“We’re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,” Biderman said. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here that was not an employee but certainly had touched our technical services.”

“You did everything you could, but nothing you could have done could have stopped this.”

I'm just connecting a bunch of dots, but it sounds like a contractor was brought in, saw this "delete" option as something scummy since they were required to keep credit card records, and decided to "go public".

As an aside, this sounds like a plot point from Mr. Robot.