Legitimate interest or not, if a UK based credit reference agency loses data in the same way that Equifax, for instance, did I think they will find GDPR has the teeth to deal with them.

It's not breaches that worry me, it's their right to exist in the first place. Credit reference agencies put Facebook in the shade when it comes to abuse of privacy and acting as a law unto themselves.

But wouldn't "deal with them" basically mean work with them and give them a lot of help and support while they try to reform their practices and prevent a recurrence, because of course they will demonstrate that none of their screwup was willful?