[roguecoder]

Criminals were already enabled to do that, and the people in those buildings had no way to know.

The more-responsible thing might have been to also reach out to residents of individual buildings & give them time to correct the situation, rather than relying on the company (which has a vested interest in ignoring the problem) to do the right thing. But security through obscurity is not a solution.

[sjducb]

Reaching out to the residents leaves you open to legal risks. You processed their data without any kind of opt in.