[russellw]

It's way at the more serious end of the scale if only because (unlike most breaches) it includes identifying information including addresses and (in some cases) ID document details.

I'm sure their head of IT Security will be looking for a new job shortly.

These companies (and Government organisations too) insist on being given our personal data and think that an apology is sufficient when they fail to actually protect that data from malicious agents - well it's not.