Comment by secalex

Depending on what he actually did to enumerate that database and whether he downloaded all that PII I think changes the risk profile.