It depends what data you had; why you had it; whether you knew you had it; and how it was hacked.

https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

> The data was taken from an underlying customer database that was part of TalkTalk’s acquisition of Tiscali’s UK operations in 2009. The data was accessed through an attack on three vulnerable webpages within the inherited infrastructure. TalkTalk failed to properly scan this infrastructure for possible threats and so was unaware the vulnerable pages existed or that they enabled access to a database that held customer information.

> TalkTalk was not aware that the installed version of the database software was outdated and no longer supported by the provider. The company said it did not know at the time that the software was affected by a bug – for which a fix was available. The bug allowed the attacker to bypass access restrictions. Had it been fixed, this would not have been possible.

That's not a GDPR fine, that's an ICO fine under a different (but similar and related) regulation (Germany and France have similar ones IIRC). The suggestion is that the US adopt GDPR-style regulation, which penalizes for infringement to procedures of data governance, NOT whether data is actually breached. (EDIT: obviously a breach will trigger a GDPR investigation)

Yes, that's an ICO fine under the previous data protection law in the UK.

Now that we have GDPR and the new data protection law ICO will be issuing fines under the new law.

This old case is an example of how the ICO regulate, and the things they'll take into account. GDPR wouldn't make much difference for this case.