I mean... that's a clear GDPR violation[0] if it's in the UK or EU. Do we know if this is still happening, and if so, how do we get the ICO involved in this?[1]

I mean... that's a clear GDPR violation[0] if it's in the UK or EU. Do we know if this is still happening, and if so, how do we get the ICO involved in this?[1] [0] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/passwords-in-online-services/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [1] The EU GDPR sets a maximum fine of €20 million (about £18 million) or 4% of annual global turnover – whichever is greater