IANAL but of you are impacted by this you should seriously consider filing a civil suit against the data controller. The most interesting article of the GDPR for you will be article 82 which entitles you to compensation if you have been materially or immaterially harmed. If your personal information has been leaked this would a clear case of immaterial damage. It has probably caused you anguish and is a violation of your right to privacy.

In this case you will have a huge advantage since there is a police investigation which no doubt will provide you with plenty of evidence to use in your civil suit.

Once you have proven that your data has been leaked the defendant/data controller has the burden of proof to show that they are in no way responsible for the damage caused to you.

As I said, IANAL, but I was personally involved in a similar case in Sweden which did go to trial (and then settled).

Hopefully there will be a class action against the data controller.

EDIT: Once again IANAL, but if you have questions reach out to me on mail@danielk.se and hopefully I can give you pointers for your research.