As a teenager I worked an evening job at one of the largest banks in the world, processing mail-in credit card orders. I would sit at a computer, run an app that could query any bank account number, and I'd get their current balance (along with all other personal info). It was part of a series of checks I had to do to make sure they qualified for the credit card.

One kid definitely got fired for querying data on persons they weren't supposed to query for.

With work-from-home, I can imagine there's employees with all sorts of access. And with them being a startup, who knows how much controls they've got in place yet.