Ravit, You highlight some important considerations for what epsilon calls "just" a disclosure of email addresses. Email addresses are not just email address anymore, they are also usernames for numerous web sites that one visits. If my email address that I use on Paypal/Ebay was disclosed, I would certainly be not happy since that email address is also my username for that site. Unfortunately, the reality of the situation is that most people fail to grasp the harm in this breach. They could care less about this disclosure. In addition to the 5 steps that you mentioned, I would like propose that the companies responsible actually create an awareness program for their customers. I doubt that will happen though. Saqib @weaselese