Privacy watchdog claims lack of ‘baseline’ cyber security controls led to 2022 hack.