They leaked far more than SSNs.

This also raises a real question about scale and distributed harm. If killing someone is wrong, what is stealing one ten-thousandth of a lifespan (through stress and monetary loss) from a hundred million people?