The site has already been reported by an affected user to the local EU data protection officer, so the legal fallout has already started.

If you still have shares in the company, sell.