While it may not contain a full roster of Personal Identifiable Information (PII), there is enough personal information and certainly strategic information that you would not want to be made available.
Protecting yourself from mistakes, audits, litigation, and enhanced scrutiny can be as valuable as stopping a breach directly. It is your responsibility to understand the risks and your options to protect your data, employees, and your firm.