"Surely the data protection act must have something they can pin on them here"
There is. Losing personal data exposes them to _private_ legal action - and the court of appeal has upheld that claims can be for distress as well as actual monetary losses.
If 40,000 people all sue for £500 each, it'll make the ICO fine look like peanuts, just in the legal bills TT will run up, let alone the actual settlements.