Just names and addresses? You think?
Some people have such a small amount of data that they think data protection regulations do not really apply to them. “We only store contact details” they say.... Well, not much to worry about there then. People are not likely to be fooled, after all, by an email professing to be from HMRC processing a refund.