Some thoughts from my side. I am not sure if I am referring to the right problem.
It's not hacking in the traditional way. It's social engineering, which uses workers as a weak spot. Due to the new Guidelines of GDPR in the EU companies can get in really big trouble when someone else gets access to the data. The penalty fee can go into millions. Small businesses are mostly an easy target because you need to be aware of this topic, how to handle it the right way, how to protect data etc.. There are good articles about it. If you are interested in this topic, this is a pretty good paper: https://www.semanticscholar.org/paper/GDPArrrrr%3A-Using-Privacy-Laws-to-Steal-Identities-Pavur-Knerr/eb73ae451c6a0fa5d32b94c0fdbcae9c5f74b308
Here is a video about such topic.
Being on the other side of the pond, I think GDPR often slips our minds, but it needs to be a concern if dealing with customers and members from the EU.
I will definitely check out the article you shared and the video and will ensure I share them on other social media and blog in the future. Thanks for sharing.