Group by country, and let them handle it.

https://www.edpb.europa.eu/contact/notify-a-data-breach_en

But I think you are asking the wrong question. The challenge is how to minimize damage.