You could assert payment from the website for your fiscal injury as they may have breached the info security law by not offering satisfactory security when processing details. Read about the rights you've got more than your individual data beneath the GDPR, the best way to training these legal rights, https://nathanlabsadvisory.com/cism-certified-information-security-manager/