Data leaks aren't 'breaches' — but they're still screwing over users