The criteria I use for sensitive breaches is that the public discoverability potentially causes harm; adult websites, for example, have a social stigma.

An increased likelihood of phishing is common to all breaches and at present, I don’t feel that a site merely being financial in nature is sufficient to categorise it along with the likes of Ashley Madison.