The leaker should have sold the data to third parties, then it would have been ok. /s