Of course the CA scandal is real, of only slightly misframed. You can't accidentally leak data that you don't store and you're unlikely to provide API access to

Of course the CA scandal is real, of only slightly misframed. You can't accidentally leak data that you don't store and you're unlikely to provide API access to data you really consider private. Did they manage to expose peoples' raw passwords? Nope, because they consider it "sensitive" data, unlike basically everything else. Had they treat social graph as private as passwords, the CA story would never happen.