Comment by GordonS

GDPR is very recent - do we know exactly when the compromise was? If it was before GDPR came in, they might be able to weasel out of any potential penalty.