Yes, when it comes to this sort of sensitive information, there is such a thing as an internal leak. We've had PCI-compliance to ensure companies handle credit

Yes, when it comes to this sort of sensitive information, there is such a thing as an internal leak. We've had PCI-compliance to ensure companies handle credit card information properly. Then we have GDPR and similar laws for personally identifying information. Access to account credentials for a large social media platform definitely falls into the sensitive & personally-identifying category.