This is so blown out of proportion... yes, letting Google crawl email addresses is not kosher, but come on, public data already includes their company name, website, and phone number, it's not like those merchants are anonymous.

Given the attention span of the folks who circulated the news in the first place, I would mention that no transaction data was leaked somewhere in the first paragraph.