You could claim payment from the website with the economic harm as they may have breached the info protection legislation by not providing sufficient security when processing facts. The eu Info Protection Board gives tips on the application in the GDPR. Info defense authorities developed new applications to raised advise https://nathanlabsadvisory.com/iso-55001-2014-certification-it-asset-management/