That vagueness is clearly designed to disguise the truth, being "going to his own company's dashboard and trying to view another which he didn't own and pressing the back key four times"
https://www.bbc.co.uk/news/articles/c5y41p0dy1woAs for the the personal residential address exposure, it is a huge breach. This website keeps certain Directors' private info private for very good reason. I look forward to the regulators, ICO, imposing an appropriately huge fine.
And just love the "if we find evidence that anyone has accessed or changed another company’s details without authorisation, we will take firm action." Firm action internally, right? Right?