> to have leaked the personal data of 10 million or more people through intent or gross negligence

But to your point, the article doesn’t define what that means.