More than 200 firms face penalties and must repay workers after breaches hit 63,000 people.