The TJX data security breach: 10-K filing shows IAM and compliance mistakes

This article goes into some detail on how TJX didn't quite come up to scratch with compliance, and questions their internal security controls .
It again raises the question of how did the secret keys get compromised if data at rest was being encrypted, with the compromise going back to 2005 but not being discovered until December 2006.