You do realize this is pure diffusion of responsibility? Something you can paraphrase as "It could have been anyone" is not an argument for this not to be wrong. I also believe the lack of empathy comment to be uncalled for. You not valuing your personal data doesnt give you the right to disregard mine. Especially with a friend, those dont profit off each other because of a personal disregard for the cost.

Its something worth considering, seeing as it has been two days and unsurprisingly nobody could come up with an actual justification for such behavior.