Five years open, flagged by its own testers, closed by a reporter. The largest document exposure on record drew under $1.5 million in penalties.