The exposure of username-to-email address mappings can be used for cross-platform credential stuffing attacks, particularly against users who reuse the same password.