They informed authorities, just as required by GDPR article 33, a good question is whether they reacted within 72 hours of finding out, given that the breach is from 2015. They seem/claim to be compliant with article 32, but I guess they should be investigated.
2 comments
[ 5.1 ms ] story [ 18.3 ms ] threadSee section 2 here: http://www.privacy-regulation.eu/en/index.htm