Seeing as this is reported by a German organisation about a Swedish company: has this been filed with the authorities under the GDPR? Any details on whether (national) data protection authorities have picked it up and warned the companies and people in violation?
No, it has not been reported to the authorities.
The analysis was conducted with the assistance of a lawyer specializing in data protection. A deliberate decision was made to share the dataset with Lovable so they could contact their customers and have the database access issues resolved.