Incident predates post-Hugging Face security procedures. Anonymization may not remove all PII.