They can be breached and in compliance with GDPR. Basically you need to do 'best effort', avoid holding on to data you do not need (data required for verifying

They can be breached and in compliance with GDPR. Basically you need to do 'best effort', avoid holding on to data you do not need (data required for verifying logins, password recovery would typically be 'data you need') - and report breaches to the authorities and end users. The GDPR does not make impossible demands like "never have a security breach".