As soon as they establish whether there’s been one breach City should be punished for that.
As soon as they establish whether there’s been a second breach City should be punished (more severely) for that one.
And so on and so forth…
If it turns out there have been a significant of breaches, I’d want there to be an investigation as to how the authorities weren’t aware of this sooner.