They're lucky it actually happened last year, GDPR fines would have crippled them if it had been post May 25th..

https://www.bbc.co.uk/news/business-44465331

Dixons Carphone has admitted a huge data breach involving 5.9 million payment cards and 1.2 million personal data records.
It is investigating the hacking attempt, which began in July last year.