+1 to this comment. PII doesn’t just mean usernames and passwords (which the OP seemed to suggest is the case). It’s anything — or any combination — of data th

+1 to this comment. PII doesn’t just mean usernames and passwords (which the OP seemed to suggest is the case). It’s anything — or any combination — of data that could be associated with someone and identify them.