> Actually this Chris guy has a point. I don't call it breach either. It's PII data exposure but it is a serious exposure.
At least California defines it as
> unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person.