Storing passwords in plain text and harvesting email contacts have landed the firm in hot water — again.