I don't think it's meaningful to talk about "a large proportion" with this few data points.

They're serious privacy violations because of the nature of the data that was exposed. We're also only talking about two organizations, both of which did have legitimate privacy violation incidents.

You're drawing conclusions based on statistically meaningless sample sizes.