Hackers use new data protection rules to scam hosts