> The impact of these two bugs was signifcant. It was access to first name, last name, address, and email of the user as well as last 4 digits, expiration date, billing name, and address of the credit cards.

Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN?

I don't know what "address of the credit cards" means, but let's assume it's the target's home address.

You don't get their credit card number or security code. You don't get access information on any of their web accounts. Correct?

If you spy on their internet activity during the flight, it's all encrypted. You won't learn anything.

However, you do have the ability to change their password, so they can't get into their own account anymore.

You could also bill all your own activity to their account. I don't know if you can bill other things to the account.

You could get access to whatever data was stored in that account. I don't know what that would be, other than when & how much you used it in the past.

Is this a complete summary of the potential damage?

Since there's no Reply button for the two answers to this:

Neither of them answer my last question ("is this a complete summary..."). Should I assume it is?

And I never said "oh but the data leak isn't really that bad of a vulnerability" -- you did.