Re: No need to compromise their systems
As for the "there's no indication that this information has been misused" (I paraphrase) - Like anyone who is going to go for a marketing database is going to email them to say "hey, we stole your data, neener-neener".
The company acted in a cavalier fashion, their staff responded in a cavalier fashion, and it blows my mind that they haven't been reported yet.