If they discovered it last week, it's notifiable under the terms of the GDPR. Given the £400k fine they had last time was ~80% of what is allowed under the DPA,

If they discovered it last week, it's notifiable under the terms of the GDPR. Given the £400k fine they had last time was ~80% of what is allowed under the DPA, I think they can expect something more substantial this time. Given they also were out of compliance with PCI-DSS, they can expect an industry "fine" as well.