Organizations often ask how much chance they have on data protection fines and how much financial reserve they should make for that. Unit 27 June EDPB guidelines on calculating GDPR fines are released for public consultation. Interesting is to have a look at the example for mitigating and aggravating factors that could influence the height […]
Legoland Germany has leaked the data of thousands of customers via an IDOR vulnerability. Just adjusting a number in a URL was enough to download reservation data dating back to 2015. This includes period of stay, names and addresses of customers who made the reservation for Legoland, as well as the people who were with […]
Bank of Ireland failed to:– report dataleaks without delay;– provide sufficient detail to the DPC;– issue communications to data subjects without undue delay;– failed to implement appropriate technical and organisational measures. Result: €463,000 fine
“Various claims are filed as a result of the issuance of duplicate SIM cards to third parties other than subscribers. As a result of the above, the holders of the telephone line are not only left without service, but the third parties access their bank accounts.” “Spanish DPA carries out research actions to analyze the […]
The German hosting company ZAP-Hosting has warned customers about a data breach in which their private data was stolen and then published on the internet. Customers are offered a discount voucher of twenty euros as an apology. Due to the attack, ZAP was forced to shut down part of the infrastructure. According to ZAP, an […]
The Google Dialer and Messages apps, which are installed by default on Android phones, collect all kinds of private data from users and send it to Google, according to researchers from Trinity College Dublin based on their own research. The apps are used for calling and sending and receiving SMS and other messages. According to […]
Criminals have managed to hijack 1.1 million accounts at 17 companies by means of reused passwords, says New York Attorney General Letitia James. According to James, the accounts could be taken over through credential stuffing attacks. Credential stuffing uses previously leaked email addresses and passwords to gain automated access to accounts. Attackers check whether they […]
The personal and salary data of 637,000 Albanians, about a quarter of the population, has been stolen and leaked on the internet. It concerns names, identity card and passport numbers, telephone numbers, salary, position and employer that are contained in two Excel documents that are shared via WhatsApp, according to the Albanian Exit News. The […]
A hacker released almost 500,000 Fortinet VPN login names and passwords that were allegedly scraped from exploitable devices last summer. While many appliances with the exploited Fortinet vulnerability have since been patched, many VPN credentials seem still to be valid. With these VPN credentials access to a network can be gained to perform data exfiltration, install […]
According to the CEO the bad actor leveraged their knowledge of technical systems, along with specialized tools and capabilities, to gain access to our testing environments and then used brute force attacks and other methods to make their way into other IT servers that included customer data.”Compromised information includes customer names, addresses, Social Security numbers […]