This comment needs to be the top one on this story. It seems the writer is missing this point entirely. It's very poor practice from Deliveroo and their support team. But there is a big difference between breach through negligence of the data controller and accounts being compromised by user negligence.