Only 5-10 made it through before I could cancel the transfers, and I deleted them without opening. We deal with sensitive info daily and so aren't totally rando people, but in retrospect, I agree, it would have been good to call one to find out who their CPA is to inform them of the breach.