They weren't fined for having their security breached. They were fined for not having adequate security measures in place. Again, under GDPR you can't get fined for simply having your security breached as you claimed earlier.