I think its damage limitation then.
Send a carefully worded follow up email apologising but saying they are not the intended recipient, as such to delete the email and attachments.
How potentially damaging is this? Is it just you who will look careless or is it damaging to your company/ GDPR breach? If it's the latter, you might need to speak to your manager before doing anything....