Of course the company reports the data security mistake to the Information Commissioner’s Office and takes whatever steps are necessary to fix the problem. They then probably release a press statement explaining how their client’s data security was not impacted by their breach and credit card details etc are safe. …