They would have read access to all of the database. However, if they also have the password, then they have they ability to impersonate that user and take acti

They would have read access to all of the database. However, if they also have the password, then they have they ability to impersonate that user and take actions as well. As an example, if you're a bank, if someone gets your database of data, but the passwords are well protected, they can find out how much money you have in your account. If they get your password, too, then they can login as you and transfer your money to their offshore account.