A data breach notification led the Romanian authority to sanction a data controller for failing to implement basic security measures, such as multi-factor authentication and the use of a virtual private network for external access, to prevent unauthorized access to its systems.

Facts and context

The National Supervisory Authority for Personal Data Processing (ANSPDCP) issued a sanction decision against Auchan România S.A., including the imposition of a fine of €8,000 (41,908 lei), for security failures in processing.

The investigation was initiated following a personal data breach notification submitted by the company itself, concerning a cyberattack.

Grounds for the decision

• Security obligation of processing (Article 32 of the GDPR): The authority found that a cyberattack targeting an administrator's account resulted in unauthorized access and disclosure of data of a significant number of internal users (identifier, first name, last name, email address, and password). It considered that this security breach resulted from the absence of adequate technical and organizational measures before the incident. In particular, the company had not implemented specific rules to secure access to its network storage equipment, thus failing its obligation to ensure the confidentiality of processing systems and services, in violation of Article 32, paragraph 1, point b) and paragraph 2 of the GDPR.

Authority's decision

Consequently, the authority imposed a fine of €8,000 (41,908 lei) on Auchan România S.A.

Furthermore, the authority ordered the company to implement technical and organizational rules so that access to all its IT equipment is exclusively from its internal network. For any external access deemed necessary, it must be secured at least by the simultaneous use of a virtual private network (VPN) and multi-factor authentication (MFA).

Lessons learned

This decision reminds that:

• Simply notifying a data breach is not enough; a data controller must demonstrate having implemented preventive and adequate security measures to avoid sanctions.
• Access to information systems containing personal data from an external network must systematically be secured by robust measures, such as the combination of a virtual private network (VPN) and multi-factor authentication (MFA).
• Securing high-privilege accounts, such as administrator accounts, is a critical point of vigilance and must be subject to enhanced protection measures.