"Thanks for self-reporting this. We are handling sensitive information in accordance with the European GDPR. Due to not having a suitable data processing agreem

"Thanks for self-reporting this. We are handling sensitive information in accordance with the European GDPR. Due to not having a suitable data processing agreement in place, you are in risk of violating national law in multiple countries. Please contact us asap to sort this out and we can notify any affected customers and report this incident to the relevant authorities." IANAL, but maybe if it's enough if your collegues might have uploaded a list of customer email addresses, some of which might reside in a EU country.