Not mistakes as such, but it'll probably invite an audit wherein they'll assess what strategies they took to mitigate a potential issue like this. If they're found to be inadequate and it also impacted a resident of the EU then maybe they'll slap them with a fine.