Techniques such as extracting operating parameters, comparing application profiles across VMs (to look for signs that one has been successfully attacked), and analyzing application behavior in memory (as opposed to just codestored on disk) are far easier in a virtual environment and provide a huge advantage for stopping the most sophisticated threats.
Instead, the investigators said, the data was kept in a hashed form - in other words the telephone numbers were transformed into a short code and stored.