> and be on the hook for damages and penalties if is malicious.

Honestly, I think both conditions might be met with an already vetted credit card number, which obviously involves an associated identification of a person or company.

When signing up for cloud service providers, I'm always terrified that I'll leave something on and incur a massive bill. Basically, every cloud service move I treat as if I'm walking on eggshells. I'd assume those issuing a DMCA would end up the same way.