It was inevitable that they would be fined a massive amount. They are a test case for GDPR and needed punishing.

Their constant head in the sand handling of this mess probably annoys the ICO too. Certainly they are still lying about cards not being used in fraud and their constant efforts to claim they are victims is simply not correct. They were negligent and deficient.