The solution to leaking private information has been known for a very long time: Don't collect beyond the bare minimum required to render a service.

Microsoft should not have collected anything beyond an email and a password. Payment information should only be held temporarily.

Personal information is a toxic asset. It baffles me why companies willingly hoard it.