‘The initial indications are that these breaches were an external criminal act,’ Ireland’s Data Protection Commssioner stated.