This artice just begs more questions:
Why did they store PII, Identity documents unencrypted?
What exactly was the reason for this breach?
Why did it take VPNOverview's team a day to notify them?
What did VPNOverview do with all that data until they notified Grink and afterwards?
Why did it take Grink 22 days to secure the files?
Why does the article describe the above as "as swiftly as possible"?
Can Grink be fined/sued over this, or is that only possible once there is 'actual damage' proven?