I had one who sent me the booking details of another client in the plaintext part. I reported it to them nearly a year ago and they didn't reply, so screw anonymity, it was Avis.

If you're in EU or California, you should probably email the local data privacy official's offices about that.

Then report it to your government authority in charge of GDPR Enforcement. They suddenly will care very much about it