The emails were "sitting plaintext in an exposed database."

Major things wrong: unencrypted email addresses + private messages, leaving the database without a password, database wasn't fixed until a week after knowing of the error.

I find it concerning that this kind of news seems normal now.