They basically decided they weren't going to pay to secure and maintain the data and since GDPR is coming in to effect it makes such a DB a liability to the company.

In which case the appropriate course of action is to simply delete rather than pay some peanuts and act surprised when the DB ends up in the public sphere. I can only commend them. Too many businesses decide to hold on to private identifiable data as though it were a prize bond waiting to mature.