I think what they mean is that the information harvested may now be used to perpetrate such scams - imagine receiving an email specifically addressed to you, containing information that you thought only Sony knew about. Would be pretty convincing (and people fall for less convincing emails all the time). Or a phone call? "Hi it's Bob from PSN here, we need to update your account with new card details following the recent security breach" etc.