Need to know the full blast radius and severity...

Bullshit. That's not for the 'whitehat' to determine.

"We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)"

You can't know that without pulling the data.