> Still, I was very disappointed that Framework chose to entrust sensitive information to a third-party who obviously couldn’t keep the data safe.

Then you're going to be very disappointed a lot. When HIBP first came out, I worried over each incident. These days, breaches of non-payment data are so common that I don't even bother to sign up for notifications.

When it comes to PII, we live in a de facto panopticon.

This was the only point I disagreed with the author on. They used metabase, a tool for their internal employees to manage the business and review their data. It's not some crazy 3rd party marketing tool or something, it's an internal BI tool that had a zero day. More zero days are coming.