That's the funny thing. Didn't it technically become a "needless and massive privacy breach" the instant the email was dispatched from their servers? Who knows who might've intercepted, read, or otherwise had access to it.

They definitely need to take responsibility at this point and contact all affected parties since there's no guarantee the data went unread.