The two propositions should be connected because how bad it is when your name shows up in some hacked company's database depends on what the hacked company is,

The two propositions should be connected because how bad it is when your name shows up in some hacked company's database depends on what the hacked company is, and being outed as someone who tried to have an extramarital affair is more damaging than being outed as someone who (say) bought some shoes. (Some people will feel that this is balanced out by the fact that these are Bad People, who deserve to have their badness exposed. If so, failing to protect the database might have been less irresponsible and reprehensible in AM's case. But it would be quite a coincidence for these things to balance perfectly. One way or the other, the service you're providing to your customers makes some difference to just how awful it is when you fail to keep their data private.)