> Mr Fowler said he had discovered an unprotected online database with spreadsheets, vehicle registration information, driving licences and other sensitive data. The online database was part of a storage system for 11 towing companies which store records of towed cars for An Garda Síochána and other entities.

Wow...

> The images exposed were high-resolution scans of sensitive personal documents that could be used for identity theft or scams including emails and texts.

Even better...

> A spokesperson for the DPC said that although it has received a breach notice from the IT services company, it was not as data controller, meaning that the IT services firm was not ultimately responsible for safeguarding the information.

And there's the trump card in all this. A lot of focus in info sec is about "transferring" risk, by which is actually meant "Make sure we have somebody else to sue."

This whole thing seems unclear, based on the way it's described it sounds like either an S3 bucket was left unsecured, or even worse some company was using a public google sheets as their applications data layer. But $10 says the security guys brought it up, were told "it's too complicated to fix now and we'll patch it later." before it was pushed to prod.