"I found your private diary in the hedge near your house, so I had a bit of a rummage around and also found your cheque book, credit card and driver's license. There's probably more stuff as well. Just thought I'd let you know before anyone else finds them"
Or, "I found that you, the bank, left all of your customers' money and social security cards and personal records (including mine) in an unlocked windowed room facing the street where anyone might walk by and steal all of it. You might want to lock it up."
"Prove it."
"Ok, I'll just show you how ridiculously easy it is to open this door . . ."
"Thief!!"
I don't know if personal information, including finances and info on your retirement fund, are like your diary. Perhaps more accurate would be "I found your checkbook with an exhaustive list of all your stocks, private information, bank balances, account numbers, etc. I recorded it all. You probably want it back?"
They aren't some online shopping store. They are a trustee.
Stealing physical goods was a crappy comparison in the GP and you didn't improve it a tiny wee bit.
The company hasn't lost anything, while both examples talk about 'taking away' and 'you want it back?'. This is the standard copy != theft analogy failure.
Note that I do understand that the company (and people affected as customers) wouldn't want him to keep a backup of whatever data he copied. Still, please don't compare it to theft, robbery or whatever.
That said, I can see the temptation to want an answer to the question "did the really leave every account open?"