It's bad if the attack involves, say, doxing the users (who may not desire this or be in a place where it is safe fort this to happen).