Personal information was available to anyone who provided the name and data of birth of a customer. The fine would have been much higher, but the company cooperated closely with regulators to quickly address the issue.

https://www.telecompaper.com/news/1and1-fined-eur-955-mln-for-gdpr-infringement–1319213