I think that was an exaggeration. They likely “just” wanted their account names and PII. It was simply not clear, and they never clarified it, which is absurd. Probably because it is illegal to ask, but if they get data willingly, they are out of trouble?