“we fixed the breach, so we are done”

The belief above is a common one, stated here in our words. It is not a quotation from the company. This is a very large company, and the amounts do not translate to yours. The structure of the findings does.

In September 2018, Meta’s Irish company reported a breach affecting about 29 million Facebook accounts worldwide, about 3 million of them in the EU and EEA. Unauthorised parties exploited user tokens. According to the authority, it was remedied shortly after discovery.

The authority’s list of fines showed this decision as pending appeal when this page was checked, so it may yet change.

Two of the four findings need no engineering at all. They concern what you wrote in the form and what you kept in the file, years after the technical fix. A breach log costs nothing to start.