Before you do that. Anyone ever done a GDPR request and seen what type of data is provided? Is it just comments and posts or some more extra user identifying details like ip addresses used and outbound clicks and so on?
Or mess with yourself when a very wrong person buys it and they've your IP logged countless times.
You might get away if you tell them that you were hacked, but there might be some trouble and a need for a new door.