Send an email with a request to remove/delete your account. They are a Dutch registered company and therefore have to comply AFAIK. Otherwise, informing the Dutch consumer watchdog might be an alternative.
I mean, GDPR also requires them to disclose the data breach publicly within 72h of detection, but it seems like they're not even remotely interested in that.
Note: IANAL