I think the scepticism comes from the fact that there haven't been many stories about small businesses being hit with GDPR violations as minor as that; not that it's not a technically, feasibly valid story.

So while I won't join in the assumption that the story was a lie/exaggeration, I am equally interested in getting the full details because I'd like to know if it's the case that minor violations like that actually are being enforced.