Notwithstanding that this information was reachable via a publicly breakable system, Sega appears to have done some right things, especially encrypting password

Notwithstanding that this information was reachable via a publicly breakable system, Sega appears to have done some right things, especially encrypting passwords and not storing payment information. However, that doesn't mean users are off the hook. Having any personal data gives the criminals more scope for data mining, especially if combined with other broken data sources. And the password files are now subject to leisurely cracking in the comfort of the criminals' lairs.