Metadata *is* data
They've leaked user data. This should be treated as the critical breach of information security that it is. No sympathy for this being hard to get right, that's a key piece of what I'm paying them literally millions of dollars a year to do.