“Alarming framing emphasizing privacy breach, unauthorized sale, and scale of exposed data without mitigation context.”