GDPR is very recent - do we know exactly when the compromise was? If it was before GDPR came in, they might be able to weasel out of any potential penalty.
And logging passports of foreign visitors is the norm in the EU - I suspect the national security exemption would apply - be interesting what the European court of justice would say if asked.
I would not imagine even the legal requirement would reduce the safeguarding requirements nor allow an increase to the necessary retention period.
Exemption for being allowed to store them is arguable, but they could still be prosecuted under data protection.