Here's the Data Protection Officer's press release (in German): https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... - the relevant paragraph is towards the end. The tl;dr is that the fine is rather low because they were very cooperative and quick to follow suggestions for improvement, and have additional improvements planned. Also, they likely couldn't afford more, and the goal of GDPR fines is not only to be effective and a deterrent, but also proportionate. The DPO says that including the cost of IT security measures taken and planned, the total expense for Knuddels is a six-digit figure.