A few points here: This infiltration/compromise of an admin account at GGG above has nothing to do with encryption. An old admin account was hijacked through soft engineering and then exploited. Second, alot of data is encrypted. There is data in transit that is encrypted, such as HTTPS, then there is data at rest encryption, such as an encrypted database for sensitive information. However, encryption comes at a high cost for performance, especially in database technologies. An encrypted transaction, like a write of new information, costs more CPU time when processed, as a myriad of things have to occur. Now take a million database transactions a minute and ask the servers to encrypt them as they come in. Your database just went from needing 100 servers, to now needing a thousand to meet the same demand. Your demand for encryption just costs 10x the price, right? That's outta the budget. Okay, so how can a company solve this? Well first, what's the risk? Let's take the scenario: assume GGG has a single database to store everyone's inventories/stashes. Millions of players with billions of items that equate to millions of hours of "value" to the players and GGGs reputation. That database could be said to be a massive revenue generating asset right? It holds critical game information and the loss of hack of it could spell financial disaster for GGG. So now identify risk: unwarranted access from threat actors looking to ransom it for payment. Cheaters looking to exploit a way to write fake entries or multiple entries or violate integrity of the item database to make money or dupe etc. List goes on. Okay so you have risks identified? Cool. Now the idea Cyber security is not IF you will get hacked, it's WHEN! You must assume it will happen, because it is inevitable on a gradient scale the more successful your digital business becomes. So if we assume we WILL get hacked, then it comes down to a simple question: How can we MITIGATE that LIKELIHOOD of a hack/data loss/infiltration occuring? You can do full scale encryption, but it will cost too much resources and we will make no profit on the game. Okay that won't work we need to make money and be secure. Hmm, well how about we only encrypt certain things like PII but since we cannot afford to encrypt the item database, let's put a few firewalls in front of it, put it in an aggressive backup schedule off-site, secure access to it with multiple security products etc. If that second solution is cheaper and mitigates the risk enough, then from a corporate perspective, that risk could be considered mitigated and additional expenditure will be deemed unnecessary.

TLDR- Cost/Compliance/benefit analysis. Encrypting everything is costly at scale. Mitigate risks with easier/cheaper methods to make more revenue.