Hacker News Reader

Anyone know the best way to get started with suing them? Or should I assume that's already being done?

If you are in the EU contact the government agency which handles GDPR complaints.

Get a lawyer. Open the yellow pages and start calling.