The Finnish data protection authority warns about an increase in data breaches targeting online commerce sites and Microsoft 365 accounts.

The authority has observed a rise in data breach notifications targeting online stores, where payment card information is stolen. These attacks often use malware and digital skimming techniques, involving the insertion of malicious code on the site to steal customers' payment data, including on sites using third-party payment services. One method, called double-hit skimming, presents a fake payment form to the user before redirecting them to the legitimate payment service. The compromise of payment card data can pose a high risk to the data subjects, requiring notification to customers in addition to the authority within 72 hours.

The authority also reports cases where compromised Microsoft 365 accounts are used for bank transfer fraud. The attacker sends, from a hacked email address, a fake account number for salary or invoice payments. The authority emphasizes that a Microsoft 365 account hack systematically constitutes a personal data breach that must be notified to it. It is also recommended to file a complaint with the police for these offenses.