If it’s an e-commerce site, than people’s payment info, name, and address. If it has a login, then their login information (which they’re most likely reusing elsewhere). Even if it’s just a static site, than any data that might be hosted on the same server.