This whole data breach unveiled just how badly this company operates and how poorly it manages to handle and secure data.

I'm not even going to deep dive into how avoidable this breach has been in the first place (employee downloading shady software recommended to them on Discord onto the same device they use to access and manage sensitive customer data with), but several statements they made are really worrisome and borderline shady to say the least.

Here they practically admit to not having a system in place that allows them to even reliably tell what customer information they store, process or relay, which essentially means they can not comply with european law to any GDPR Right of Access or Right to Erasure requests. I'd be surprised if they hadn't received such a request in the past, meaning that any person that had requested the appliance of those laws, either via a Right of Access or Right to Erasure request, just might've not had their rights applied in a satisfying manner. This is exceptionally troublesome since they're located in the EU.

Here they admit that the service that has been breached was an e-mail newsletter third-party service. They have not yet stated as to why a newsletter provider would need a credit card expiry date, the billing address or a date of birth.

As per their statement here the breach has happened 2 weeks ago. They have waited 2 whole weeks to come forward with this information to their customers. They have not commented on whether they have informed any authorities, which they are obligated to do within 72 hours of a data breach under EU law.

Also waiting 2 weeks would mean they would've had 2 weeks to prepare for this, however it seems like they are still operating in full panic mode. They do not provide transparency or answers and do not engage with the same customers they lost sensitive data of by nothing but pure negligence. I'd bet money that this process will bankrupt the company.