I have seen the actual website of the group that committed this crime and they are openly displaying deeply private and personal documentation like a passport of an employee and letters from HRthere's a very real chance there are personal records in there (addresses, credit card info, emails, personal documentation). The ransom note basically suggested as much (but it could be a bluff).
some would also make the argument that if an artist doesn't want people to see their drafts it's a violation of that privacy