But do you need those data items for every single client all at once? Why not (weak example to make point) one login for customers A through M and another for N through Z? If someone breaks security for a system, they should not ever be staring at a database of *everything*. Maybe divide customers by region? Or class of freight? It is insane to me that any user's login carries the ability to see all the data downloaded in this attack.
They're a logistics company. They take in products that are to be shipped to people. Likely they come in as the orders happen. So it's likely just a simple FIFO queue - someone from Steam buys a Steam Controller and their details get entered into the shipping database in FIFO order. As people work to package and ship product, that order will come up and whoever's the lucky person takes a steam controller, puts it in a box and slaps a label on it, then enters in the tracking information and tosses it on the shipping pile.
It's likely not ordered by anything - other than maybe the order the orders came in as. If someone else orders a widget after the guy orders a steam controller, the next person then gets to pick the widget, pack it into a box and then move on.
The database in question only contains orders up to 100 days old, so it's likely just the active database containing the orders that need to be sent out and orders that were sent out. Anyone fulfilling orders will need access to it so they can see what product needs to be packed and where to send it off to.
It's not a database of "every single client". It's a database of orders that have been shipped out and less than 100 days old and orders yet to shipped out because either they are being held for supply, or they just haven't gotten around to handling the order yet.
The 100 day history is so if there is a problem, it can be traced - if a product doesn't arrive, they can look at the order and figure out tracking. Or if there's a problem and it needs to be returned, it can be traced to the original shipment for RMA.
As far as it looks, other databases weren't compromised, which can include inventory information - what stock is on hand and where it is in the warehouse, or their customer information (as in who buys their services). The only thing compromised was the active order table which likely has lots of access out of necessity as people fulfilling orders need to read the database to get the orders, and backend systems like Valve need the ability to read, add and delete order entries to see what order status is, the ability to add an order, and the ability to cancel a shipment that hasn't gone out yet.
It looks like a perfectly reasonable way to segregate the business. They aren't storing your name, address, phone and email, it's just information that's needed to fulfill the order and any post-shipping issues that might arise. And it looks like that database was compromised