Controllership can be determined implicitly from national law, even for an official journal that only publishes data as it receives, including when that journal doesn't have a legal personality (but note my comment on this!).
Unauthorised disclosure or access doesn't equate to inadequate measures, but must be proven to prevent damages claims. National courts must assess your case concretely and cannot systematically rely on expert reports. Mere fear 😱 = non-material damages (but must be proven by the data subject).