A music website that competed with the one I worked for (and with whom we were quite chummy, hence me having some inside information) had their entire database cloned by a rogue dev who then sold it on the black market. The first sign for users that anything had gone wrong was an influx of spam to their addresses, even though the database had far more nefarious potential uses.