If I understand correctly you are already required to report the data loss according to GDPR and you'll be fined accordingly, whether the data is then leaked or not.
Isn't the clear course of action then to report, pay the fine and tell the criminals to get lost?
"But some Chinese are unaware that it even exists. And many others actually like the idea. One survey found that 80% of Chinese citizens surveyed either somewhat or strongly approve of social credit system."
How many people actually like the idea and how many claim they do because they want to score points? The endgame is that the government can do whatever it wants and claim it is with "the support of the people"