A list of 1,000,000 people is a high-value target for hackers and a major liability for privacy regulators.