user data scandal