Email addresses are absolutely personal data, and in the EU companies need to protect that data from being leaked.

(There would probably not be a fine; the company would be investigated and warned by the various regulators).