They hired an investigator? Any investigator worth a shit is gonna say that they’re liable for failing to secure private data they collected, as well as for retaining data they were apparently legally obligated to delete