If a company's user email list is hacked, how much harder is it to attack other information? Financial information (e.g., credit cards) usually get extra security, but plenty of other information is typically stored right next to email addresses (e.g., user behavior history, IP addresses, signup dates, pricing info, password hashes, friend connections, etc etc etc).

So whenever a company says that only their user email addresses were compromised and nothing more, I'm pretty skeptical of the validity of their assertions.