the laughable part of all of this is seeing so many people here thinking that whois "privacy" is somehow supposed to be some sort of impenetrable shield... the fact is that anyone can get the underlying registrant data with very little effort at all, from ANY registrar.
hardly the point being debated.
Point is someone who had access to the information within the organization accessed that information for personal gain.
I worked at a hospital with 16,000 employees. Perhaps 10,000 or more had access to every patients' chart, past and present. Only one that I know of used that information for personal gain...opening credit card accounts in deceased patient's names.
Yeah, that's a crime.
Point is it is not how many have access. It is what those that do have access do with that access.
Any data is never 100% inpenetrable as long as one person has access to it. Any system is only as secure as people make it...or break it.
It's a damn shame somebody pays for something and then someone who has access takes a look-see. Nothing was penetrated, hacked, attacked, broken into, or stolen...