Information security incident by ISO 27001 vs. personal data breach by GDPR

I am working on internal information security incident procedure and have some doubts concerning correct classification of the following event: Let's say we have found system vulnerability which can be used and lead to unauthorized access to personal data. Fortunately it's been found in advance and removed by IT unit. I believe such case should be classified as information security incident in accordance with ISO 27001. But what about personal data breach?? I am almost sure that such event should not be classified as a breach in accordance with GDPR, since IT unit prevented possible attack by removing vulnerability as well as supervisory authority. should not be notified too