Leaked is the best word. It doesn't even have to be hackers or outside forces. An individual on the inside maliciously or ineptly handling records is another way things will get leaked. And will is the right word. In the digital age it's not a question of if something will get leaked, but when. And as systems become more complex and companies more expansive this is only going to become more true. And I think this is the point of view people should make when deciding what information to yield to companies, or deciding on their position of things like 'surveillance for your safety.'