Privacy only? What do you mean? If you had requested in details in sms often your account can be profiled with some basic parsing. The hacker can create highly accurate targets for social engineering. This is a massive blunder.
He meant, it could have been worse. They could have changed your details. The phone number associated with your account, for example. Or they could have added transactions.
