In addition to having been hacked, I suppose the security policy was violated by having pii leaving the (logical) premises unencrypted.