Pretty big red flag, as if the revelation they were having a data protection amateur hour wasn't enough