I'm waiting for the first time a GDPR DSAR deletion/retrieval portal is breached. Mass exfiltration or mass deletion are both great attack vectors.