I find it fascinating that Google gets a 50M fine for not having the exact UX experience France thinks they should have but then fines a French company 250K for breach of actual user data. Makes sense.
GDPR fines are intended to generally be proportional to the company's revenue.
Furthermore, this is the first fine falling under GDPR. The previous fines handed out by the CNIL were pre-GDRP, with much lower maximum amounts (300 k€). So a 250k€ fine is close to the maximum they could fine, which makes sense given the offense.