Particularly when you're providing a hardware wallet presumably storing a lot of funds.

There are practical reasons to use these systems of course. It's just a known hazard.

The real question is why you are giving your customers data to a 3r party. 

> This data breach contains minimal contact information of active contacts that signed up to our mailing list or placed an order within the last 30 days:
> - Name or alias
> - Email address
> - IP address of your computer (e.g., 36.172.17.116)

Why on earth are they storing IP addresses or frankly anything but the email addresses?