Eh, I'll believe it when something actually comes of it.
Xbox Live is a paradise for social engineers, that's true, but that's usually as far as it goes. A 'Microsoft Account' is a valuable item, as you can potentially get more from it than just game related stuff. That's why I despise the idea of everything being linked.
It's also true that crooked employees can do some damage. A customer service rep, especially one that's contracted and works from home, can write down client information as people call in. They'll get suspicious if you're accessing profiles at random but not if it's a normal part of your work-flow. A good chunk of Xbox support is work-from-home.
Most of it is just people giving away their information for free, though. Hell, you can get half of what you need to get into someone's account from Facebook. Social engineering is easier than it's ever been before.
