Technically correct? The "M" in "NVMe" is for "memory".
Maybe not a popular take but This is kind of a victimless crime. They mishandled private data but so did Experian (for example) and she never had a breach! On all the other charges I'd argue the tech companies poor security processes were by design because it generated more revenue.