"NRA spokesman Andrew Arulanandam said on Twitter that the NRA “does not discuss matters relating to its physical or electronic security” and takes “extraordinary measures” to protect its information."
Laws don't remove the motivation, they just create an incentive to do the opposite. That's fine if you just want a company to fear punishment, but you quickly get to the point where compliance is an expensive exercise in finding loopholes.
I'm guessing they paid the ransom.