Sixteen months with valid logins, used to poach customers. Those who phoned to check the notice were told it was spam.
A crash report exists because someone was in a collision. No vulnerability was exploited — a valid account did a permitted thing 300,000 times.