Company A in US organizes a tour for its US customers which includes the tour of Europe and India. Company B is a Travel Services management company based in Paris and manages the EU leg of the tour. Company C is a Travel management company in India and handles the India leg of the tours. Three months after the tour, company B receives a notice from a hacker that the data of the tourists would be released in the darkweb if a certain ransom is not paid. Discuss the liabilities of A$,$ B and C in the context under GDPR and mutual recourses.