So the attacker claims to have harvested the data via the API. Looks like you can get any user profile if you're an approved developer. Possible the attacker s

So the attacker claims to have harvested the data via the API. Looks like you can get any user profile if you're an approved developer. Possible the attacker slowly downloaded the whole database.