My takeaway: whenever private data has inadvertently become available to outside actors, you should treat as a breach, even if you don't have evidence of exfil

My takeaway: whenever private data has inadvertently become available to outside actors, you should treat as a breach, even if you don't have evidence of exfiltration or malicious use, and even if you first found out about the issue from a bug bounty program (legitimate or otherwise).