It sounds like the GDPR is more or less unrelated and those fines are not forthcoming. If deliveroo's own analysis is correct (and that is admittedly an 'if',

It sounds like the GDPR is more or less unrelated and those fines are not forthcoming. If deliveroo's own analysis is correct (and that is admittedly an 'if', but if you come out and say 'we hash our passwords, and you can quote me', let's assume they aren't complete morons in thinking that nobody on their staff would ever leak it if they didn't), then the problem is not that there has been a security breach over at deliveroo. The problem is merely that [1] Their handling of a breach of account info that they weren't the cause of is very bad, both not investigating / blocking the recipients of the food orders (clearly 'whitewashing' fronts), or even trying to take it seriously, and [2] doing a bad job at enabling (or even motivating) their users to have good account security. Anywhere from scanning such credentials lists out in the wild and autoblocking any user/pass combo that is also a valid deliveroo login, to offering TOTP. Both are, to be clear, very bad. Deliveroo deserves all the scorn they are getting. But neither of these issues is something you can be fined for, at least, not via GDPR.