A research team removed names and account numbers from a mobility dataset before release. Another team nevertheless matched a few unusual sequences of locations and times with public event photographs, thereby identifying several participants. The demonstration does not show that every record can be reidentified, but it undermines the assumption that deleting direct identifiers is sufficient protection for highly detailed behavioral data.