> I think it's worth mentioning that GDPR was basically exactly this.

There is very little the GDPR would have done to prevent this.

The data was legitimatly collected from customers. It was leaked because of badly configured server or firewall. The company is no longer in business so no fines (or minimal fines) would be paid.