We can see 3 three security mistakes in this statement - "The data was stored on unencrypted hard drives in payroll worker’s computer equipment placed in the worker’s vehicle

1.  No encryption (obvious) 
2. Sensitive data was stored on hard drive (why?) ;
3. No DLP (security budget cut?).

So, where is Facebook spending its security budget? (on products and people producing fancy dashboards?)

https://www.hackread.com/unencrypted-hard-drives-facebook-employees-stolen/