Large PII dumps such as this serve as a reminder to organizations that how data is handled is of the utmost importance. Because this database was created and used by a third-party vendor, policies about data handling may or may not have been enforced. As it pertains to privacy, using non-name identifiers can soften the blow if the information is leaked. Most importantly, assurance that proper controls are put into place when data is hosted in the cloud could have prevented the easy access of data. Organizations ought to consider and implement security tests and audits on a regular basis to document what systems pose a risk to organizations and, most importantly, their customers.

https://www.bleepingcomputer.com/news/security/audi-volkswagen-customer-data-being-sold-on-a-hacking-forum/