Authentication, authorisation and monitoring all worked. The difference between a legitimate lookup and this one is intent, and intent is not a field.
Between $2,600 and $5,700 per person, against a sector norm of twenty dollars of credit monitoring. The difference is not generosity.
No vulnerability. Authorised employees performing lookups they were entitled to perform. The security model was not defeated — it was rented.