The answer is SQL Injection
This kind of attack is the most prone to extract privacy data elements out of a database. An SQL injection like any other attack may take several attempts to pull it off and is more likely to extract private data. With admin rights or escalated priviledges, SQL injections can be used to enter the database.