Wow — not just passwords but phone numbers, full names and physical addresses all breached. And it happened in April 2016. Surely this should've been reported much earlier due to GDPR requirements?
Not just addresses, but coordinates.
Inclusion of the delivery notes is interesting too.