[benja123]

To be fair I don’t think I have ever been notified by any company when my data has been leaked and according to haveibeenpwned that has happened quite a few times.

I am not a lawyer, but I find myself wondering if they are binded to GDPR in this case as judging from online articles the actual “leak” itself may have happened prior to May 2018. It also maybe that the nature of the PII itself is not such that it needs to be reported to the users (no passwords, private messages etc...)

[cdolan]

I have been notified many times by reputable firms that my data has been taken, even if it was just a password.

Most of the stuff that I appear on havibeenpwned for is some strange data brokerage that probably grabbed my data from another hacked brokerage, etc