Are organisations fined in the case of a zero-day attack?

Exactly what the title suggests. In the case of a zero-day attack on an organisation (which I know is very rare), if PII or SPII is compromised, does the organisation still face fines and penalties?

attack case compromised cybersecurity fines organisation penalties pii zero-day zero-day attack