I don't want to sound sarcastic and paranoid, but working in the software security industry, I can almost guarantee everyone's personal data has been compromised long ago. There are two types of companies, those who have been breached, and those who have not discovered they have been breached.
Grab a good bottle of wine and read this;
https://www.ictsecuritymagazine.com/wp-content/uploads/2017-Data-Breach-Investigations-Report.pdf