[krebsonsecurity]

The story was clear that this was only an estimate of damages. It also stated clearly that the investigators were somewhat constrained by the fact that Ngo's services did not keep reliable records of sales -- only what customers searched for.

I should add that in this case, a search for John Smith in Massachusetts would turn up all the John Smiths in Mass. The resulting sale (if there was one) could have been for all of the John Smiths in Mass, some of them, or just one. We don't know. This also made the notification of victims much more difficult.