About half of the recaptured phished data included specific city or postal code information.