Anomaly?
"[...] that our system had been used in an attempt to access member's data [...]"
1. It is not an "anomaly" if it has been designed that way.
2. Passive voice – "our system had been used to..." – in an attempt to deflect blame (it was the system, not us)
3. "... in an attempt to ..." – forgot to mention it was a successful "attempt"
Such a blunder means that there wasn't an "anomaly", it is a complete fail of incorporating security into the design of the system. Makes you wonder how many more "anomalies" are there, maybe just not as obvious to find as this one.
"Secure by design? Yes, we've read about that somewhere, but we didn't understand it."