Like handling nuclear material, if a company is going to collect intelligence on consumers, they have a social obligation to secure that intelligence. Encrypt it, tokenize/anonymize it, or delete it after use. Anything less and you're simply positioning yourself as a facilitator of doxxing or stalking when data leakage or exfiltration inevitably happens.

If it was this easy to break in and access the data, the hacker did consumers a kind mercy by deleting it before someone else got in and did something more nefarious.