Data breach at NSLI-Y

Did anyone else get an email today from American Councils for International Education informing them that their kid’s info was exposed?
I’m infuriated.
My D19 applied to NSLI-Y years ago. Apparently they stored all the supporting documentation. And gave admin access to some who applied this year - so they could view all the stored data.

From the letter:
“That access enabled those individuals to view records and personal data belonging to other applicants, finalists and participants, including education records, medical records (including mental health records, where applicable), requests for accommodations (physical, health, visual, learning), insurance information, passport and visa records, naturalization records, birth certificates and other government identification.”

They go on to assure me that no credit card data was exposed
Like I care, when my kid’s birth certificate and passport were available???

Ugh ugh ugh.
No recourse. Just a boilerplate “what to do if you’ve been breached” form attachment.