In addition to this, as per GDPR, the personal information (name, passport, address, email, phone) should have been encrypted in the database, just as the payme

In addition to this, as per GDPR, the personal information (name, passport, address, email, phone) should have been encrypted in the database, just as the payment details were. This would have reduced the effect of unauthorized database access. I'm guessing this was not done either, even for EU guests.