> your non-user data at risk.

That sounds like a GDPR fine waiting to be issued right there.