The latter. Undoubtedly.
The Met have >43,000 staff (~31,000 officers). Surrye have ~3600 staff including ~1900 officers.
With 10x as many staff it is not credible to suggest that the Met genuinely have 1/3 as many data-breach incidents as Surrey (18 vs. 50).