I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc.
After dealing with this I noticed that the hacker had also compromised files of an old copy of the site which was still in the public_html directory (or they'd created it themselves).
Checking the wp-config file there, I found access credentials to a database with several thousand tables, all of which were Wordpress tables with different prefixes. I looked in a few of the "options" tables to find the address and visited that url, confirming my suspicion that these were copies of other hacked site's data.
It's important to note that I haven't accessed any personal data, only public-facing URLs of wordpress sites.
I am unsure what to do about this - my instinct is to try to get a list of site owner emails from this database, then drop all tables & contact the site owners to let them know of the breach. However I'm not sure if I'd be liable for this as I'm obviously not permitted to have that data either.
I'm in the UK so GDPR is relevant.
Should I take any action?