they hired a 3rd party to verify the leads and they basically checked that the row count was 4m and said yeah these look like contacts. if whoever was in contact with this vendor thought this was adequate, that's pretty bad judgment. how hard would it have been to validate a few records?