If the boards contained personally identifiable information and then that data was transferred so that other people could access it, wouldn't that be considered a data breach?

I guess people affected by this could submit a subject access request to get their data back.