Between $2,600 and $5,700 per person, against a sector norm of twenty dollars of credit monitoring. The difference is not generosity.
No vulnerability. Authorised employees performing lookups they were entitled to perform. The security model was not defeated — it was rented.