Yes. We had numerous SSN and bank account details, basically anything you might find in a personal or professional email inbox. Obviously we weren't making use of any of this, but if we had one malicious engineer, things could have gone very poorly. One automated tool inadvertently posted an individual's SSN on the paid version of our site was very angry. The level of access was something we were always discouraged from discussing with sales folks and management always kept things very vague.