Not putting appropriate access controls around that data is a choice and one that I hope they end up paying dearly for in court.