If you're in Europe I'm guessing that you have a GDPR breach case.

Note that I'm not a lawyer and don't pretend to be one on the internet.