When shared details of a serious data-protection i...

When shared details of a serious data-protection issue this company will respond with legal threats instead of resolving them; Don't ever trust any party like this with your data! The company has neglected updating their web frontend (and potentially backend) for over 5 years and clearly does not understand how that makes it part of their own inresponsibility.
At least 49.000 users' data turns out to have been effected and the site has for more then half a day now stated they would be back in a few hours (adding more insult to injury showing they don't understand the gravity of the situation in the slightest).

(Note: users must pay just to register, this means that all affected data was from users paying for this service. Which is beyond just unprofessional to not take care of.)