In this case the fine has nothing to do with keeping data secured.
2. Failure to comply with the obligation to provide information
3. Failure to ensure the security of personal data
4. Failure to carry out a data protection impact assessment
While not a direct security breach investigation, these have high impact on user data. (edit: formatting)