So a private data visualization company was CC'd on an email that included a download link to some voter data. Note that the link doesn't work unless you're logged in (try visiting that download link yourself), so no voter data was actually sent to that company. And an employee at that company wrote a tweet on their personal twitter account in support of their country's intelligence services.

That's all? This is weak sauce. Given the company's area of expertise, this is probably just a hacky way of getting metrics on what reports have been sent out.