If I remember right, date of birth and address used to be right there on the company page. Led to credit being taken out in my name, which luckily got picked up.

Only technically possible, so not so bad. /i

And more weasel words at:

The issue could only have been exploited by a logged-in user performing a specific set of actions.

At this stage, we have no confirmed reports of any data having been accessed or changed without permission, and we believe the issue could not have been used to extract data in large volumes.

The "specific set of actions" is so vague that could range from just opening a specific company page and clicking on a button to performing a complex chain of steps.

This said, it's not that bad, that's true. But the idea of having the personal residential address exposed is not great either.

[delayed]