From a recruitment firm, which was sent to lots of other people (strangers) and I can see all their email addresses. This is obviously a breach, do I have a responsibility to do something about it?