> January 2022, we received a report

And they did not give notice to users. GDPR breach.