Case A: An attacker knows person A has account number 123. They also know that this person has a tablet, a phone and an Apple notebook that A always takes with them when leaving the home. A uses Twitter and a couple of other social networks that those devices sync with in regular intervals and syncs to iCloud (which can happen while the notebook is closed).

I'd be surprised if this constant chatter isn't visible on the graphs.

That means: The attacker can track rather well whether the person is at home or not. Or at least make informed guesses. They plan a robbery during a holiday. Or, much more malicious: some attack on the persons other web properties like their iCloud and Amazon account, as presented a while ago.[1]

Case B: Consider that the attacker doesn't have the account number. Another leak in their platform allows them to link personal information with account numbers. In itself, that info is also not very interesting and would also not be "dangerous".

Because the leak of the traffic graphs exists, they go on and plan the biggest heist in Toronto ever :).

A good exploit is often the combination of multiple seemingly innocuous flaws. [1] is also a good example of that.

[1]: http://www.emptyage.com/post/28679875595/yes-i-was-hacked-ha...

You could send large amounts of data to an IP in sporadic bursts, find which graph correlates, get their account number and use that as a starting point for social engineering the helpdesk staff.

Elaborate, sure, but plausible. The more important part of the leak is all the account numbers anyway :).

I'm pretty sure that "have access to someone's account number once" => "have access to past and future traffic usage forever" is not good security practice regardless if there are or are not obvious vulnerabilities, and you really don't have to think very hard to construct a scenario where it can be abused.

Security isn't about mitigating danger.

You're leaking information that you aren't supposed to.

There is no benefit or legitimate use case for this leak; it is a leak.

You gotta plug it.

A good one mentioned in the OP comments is deducing when people are on vacation due to their traffic usage (or rather lack there of). Also, we don't know what other information may have been listed there. What if they decided to add your name and IP address to the graph?

That's with an assumption that the data was anonymous - an assumption we don't know was true. Was there any account/customer number, IP addresses, naming scheme or similar in the graphs or file names ?

Not one serious reply to your statement. Makes me think you're right.

On the contrary, I consider these good answers.