Only Limited Data Stolen
According the email I received, only limited data was stolen.
"Only limited information was held on this database consisting of full name, delivery and billing address(es), email address, phone number, final 4 digits (only) of payment card and/or order details."
That limited data included my full name, billing and delivery addresses, email address, and mobile phone. So everything needed to impersonate me or scam me then. Pretty damn sure that covers most of the PII.