I had one who sent me the booking details of another client in the plaintext part. I reported it to them nearly a year ago and they didn't reply, so screw anonymity, it was Avis.

If you're in EU or California, you should probably email the local data privacy official's offices about that.