Billing? ID -> balance. "Very" important data for hackers. They had more? Like card numbers, names, addresses, etc? That's a bad practice for VPN providers.