GDPR can affect businesses in the United States (or any other location) if information is held by that business in the EU.  GDPR is concerned with information held within the EU as opposed to the [...]

Unfair requests or excessive requests relate to requests by individuals for data which are manifestly unfair or excessive.

This is a data breach which even though it has occurred is unlikely to result in damage (for example a laptop has been lost containing personal data but is encrypted or is facilitated with remote [...]