An outsider being given access to confidential customer information in Europe would immediately be flagged as a GDPR violation, and given the circumstances it would probably be a reportable one as well. Don't make light of this.