A credit company was sanctioned for failing to implement adequate security measures, notably by not regularly testing and evaluating their effectiveness, which led to a massive data breach following a cyberattack.

Facts and context

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) issued a sanction decision against HORA CREDIT IFN S.A., including the imposition of a fine of 53,370 lei (approximately €10,000), for failures related to data security.

The case originated from the notification of a personal data breach made by the company itself, in accordance with Article 33 of the GDPR, following a cyberattack.

Grounds for the decision

• Obligation to ensure the security of processing (Article 32 of the GDPR): The authority found that a cyberattack had resulted in unauthorized access to the personal data of a very large number of individuals (clients, employees, collaborators, current and former), affecting their confidentiality and integrity. It considered that this situation resulted from the absence of appropriate technical and organizational measures by the controller. More specifically, the controller had not implemented a process for regularly testing, evaluating, and assessing the effectiveness of its security measures, thus failing in its obligation to ensure the confidentiality, integrity, availability, and continuous resilience of processing systems and services.

Decision of the authority

Consequently, the authority imposed a fine of 53,370 lei (approximately €10,000) on HORA CREDIT IFN S.A.

Lessons learned

This decision reminds that:

• The occurrence of a data breach resulting from a cyberattack may indicate a prior failure to implement appropriate security measures.
• Compliance with the security obligation is not limited to implementing technical and organizational measures but also requires establishing a regular process to test, evaluate, and assess their effectiveness.
• Protection of information systems must cover the entire processing scope, including not only client databases but also operational documents, electronic correspondence, and human resources data.