Personal data vulnerability confirmed