They have obligations under GDPR to report the issue to their DPA within 72 hours.

The fine for breaching GDPR can be either €20m or 4% of global revenues (whichever is the larger figure), so if I were them I'd do everything possible to sort this issue out ASAP.