Well it also depends on what is considered a 'user'. For example let's say you had 'only' 50,000 users. So you then pack the database with hundreds of millions

Well it also depends on what is considered a 'user'. For example let's say you had 'only' 50,000 users. So you then pack the database with hundreds of millions of fake users. The purpose of the fake users is simply to lessen the probability that the real users get their data used in some way. Further to the point if the number of fake users is high enough it makes it more difficult to sell the data because nobody knows what data is fake and what is not (sure you could cross ref it with other data but that would take some effort). And even moreover a news story saying that 25,000 users data was stolen is not a big deal. A news story saying that 1 billion users data was stolen is a big deal. And then brings up the obvious question of whether the stolen data is really real in some way.