I say that they shouldn't have any sensitive information at all. And their claim that it was testing data that leaked shows that they do have that sensitive information. It just hasn't leaked yet. At least if we believe in what the company says.