[bastawhiz]

It sounds like the data leaked was not PII, which is outside the scope of GDPR personal data breach guidelines.

[magicalhippo]

Filenames were leaked, which could very well contain PII.

[Nextgrid]

Something as simple as an IP address (which you're implicitly leaking by just loading any resource from the third-party domain) is considered PII under the GDPR.