This is a good reminder that a lot of security risk comes from the tools around a product, not just the product itself. Even well-run systems can be exposed if a vendor integration has broader access than expected.

The practical takeaway is to keep reviewing what data each service actually receives and to keep permissions tight. Most companies use analytics tools, so incidents like this are a push to double-check how much they really need to see.