I guess we always suspected they may do this, it's really bad and also really stupid. You can't just decide to do whatever you feel like with user data. A site needs to have a privacy policy which sets out exactly how they can use your data, which the user needs to agree to.

Not only do they still not have a privacy policy (though it looks like they finally have terms of service), but doxxing your users is never an acceptable use of user data. They can be taken to court over this and I hope they do. They're too large to claim they're just a hobby instance and didn't know any better.

That said, that Carcossa guy is a clown.