In the article, Rapleaf says de-anonymized linking of ID's to real names "wasn't intentional." That's a little hard to believe -- isn't the point of the company to have a massive person database of information like this?
http://blog.rapleaf.com/referrer-urls-and-privacy-risks/
Though it doesn't seem to explain the details of what happened. It would have been useful for them to include the specifics of what occurred and exactly what data was erroneously transmitted to whom (a la Foursquare's post-mortem from a week or two ago.) This could be as valuable a lesson for system architects as the 4sq one was.