If you did not know the breach has occurred, you're legally in the clear. Once you do know, you have some obligations. For bigger companies, you have to appoint a data protection officer who is supposed to know. (This includes big as in amounts of data too.)

If you're using a third party service, you will have to use it with prejudice. No more randomly including J. Random noncompliant Ad Agency as a middle man illegitimate handler and washing hangs of it.

Also URLs are perfectly fine as you're not processing the data. The thing that changes is that you have to specify which third party service you use and that it is externally managed. Probably link to their privacy policy and they also have to be compliant with GDPR. This will make it possible to actually get rid of the images and protect your privacy.