Hacked on Christmas, DEphoto starts notifying customers, only to be attacked again

A threat actor known as 0mid16B claims to have breached DEphoto, a U.K. photography business, on Dec 25 and again on Dec 29 after the company allegedly failed to secure or monitor a restored system; the actor says they exfiltrated ~555,952 customer records, ~429,597 orders (with ~240,307 detailed orders), hundreds of gigabytes of photos including images of children, and 16,213 records containing plaintext credit card numbers, and demanded £50,000 — screenshots were provided and the actor intends to sell or leak the data.