If a teenager has managed to gather personal data on 10000 people, including sensitive data, then they damn well should be able to protect it.