Wow — not just passwords but phone numbers, full names and physical addresses all breached. And it happened in April 2016. Surely this should've been reported much earlier due to GDPR requirements?