I mean, it is kinda their fault in the first place for using an optional corporate service that stores very private data of yours which could be used in malicious ways.
Maybe there should be some type of regulation that prevents that from happening considering the average person doesn't think of shit like that because they don't expect to be fucked over in every conceivable way