Careless engineer stored recovery codes in plaintext, got whole org pwned