Most of 1.4 million customers, advisers and employees. A CRM accumulates every population an organisation tracks, and so does its blast radius.
Employees of a customer of a processor. Three steps from the incident, with no point at which they could have exercised judgement.