I had one who sent me the booking details of another client in the plaintext part. I reported it to them nearly a year ago and they didn't reply, so screw anonymity, it was Avis.
If you're in EU or California, you should probably email the local data privacy official's offices about that.
If you're in EU or California, you should probably email the local data privacy official's offices about that.