Yeh, I assume this a GDPR violation in the EU (I mean the business model seems like it violates GDPR, let alone the actual data breach).