What data was exposed, and to whom? Single records accessed by a white hat to test a vulnerability do not count.