They probably stored all those generated private-keys on one single repository, unencrypted. Ouch..