3 ms·

I'm not even sure if their disclosure meets the requirements of the GDPR, considering the breach involved user data.