What a bunch of liars
"we process publicly available business contact information, and do not collect, store, or process consumer data or any type of credential information or sensitive personal information including accounts, passwords, home addresses or other personal, non-business information"
Oh yeah ? Then how do you explain that you had physical addresses of people on a server that decommissioned for two years AND NOT SHUT DOWN ?
There should be a law specifying that, if you deal with data that can identify physical individuals, you must have the proper procedures and protections in place or else you go to jail.
Take 'em behind the chemical shed and shoot them.