CBA acknowledged a system infrastructure configuration mismatch where internal customer visibility matrices allowed certain commercial financial planners to view unencrypted records and profiles of clients outside their explicit care directories.