70,000 seems like a lot. It makes me wonder if this is an internal list of people who were actually caught stealing from this specific chain of stores, or maybe it was something like a black list of known shoplifters that is shared by the retail community or acquired from a 3rd party provider. I'm just theorizing here and maybe drifting off topic, but I can imagine a scenario where retailers have facial recognition functionality built into their security camera system, and then they subscribe to a mugshot database of known offenders. Why else would the store maintain a database of shoplifters?
70,000. A lot and not a lot. Most breaches are in the millions, so this is fairly small.
I'm not sure this was just shoplifters but suspected criminals. no idea why they keep this, but it's not a great idea to not secure the data.