Holy crap.<p>Poignant quote:<p>"When the company’s technical staff discovered the bug in March, they decided against disclosing the issue to users because they hadn’t found anyone that had been affected"<p>Later it becomes clear that this is because the data couldn't easily be associated with users. But still.
There's already a lively discussion at <a href="https://news.ycombinator.com/item?id=18169243" rel="nofollow">https://news.ycombinator.com/item?id=18169243</a>.