For the vast majority of users Garmin have ZERO liability re data retention. They could just say WHOOPS! and zero all accounts and require everyone to resync. And I would have respected them for that as they've now sent $10M to these assailants to increase the sophistication of their attacks and retain/lure/entrap more skilled developers. But then I'm a bit of a moral absolutist.

If their financial records were all toast too I wonder what the fines would have been ...