Quite possibly. If you are a data subject affected by this affair you can contact your local DPA.

And if I don’t see fines against Lovable and they don’t report this as a breach, it would seem to suggest that your stance across this post isn’t the degree of absolute fact you’ve presented it as?