These clowns were responsible for getting a key as part of the process of getting an import/export license in India. It used to be a requirement to get a USB hardware key from them. India doesn't have any stringent data protection laws, so nothing will happen to them, even. None of their customers will actually even get to know about this incident unless they hear about it from elsewhere as most of the times, Indian companies never communicate such breaches to their customers (Eg. Domino's Pizza India had a massive breach and they never even sent as much as an email). It's really a sad state for privacy.