The Spanish data protection authority sanctioned a company for a data breach resulting from the lack of basic security measures, including encryption and monitoring, on a poorly integrated IT system following an acquisition.

Facts and context

The Spanish data protection authority (AEPD) today published a sanction decision against COINSOFT 21, S.L. (including the imposition of a €3,000 fine) for failures related to the security of personal data.

The case originated from a data breach notification by the company itself on June 17, 2024, supplemented by a complaint from a former employee whose data had been compromised during the exfiltration of 300 GB of data by a group of cybercriminals.

Reasons for the decision

• Obligation to ensure the integrity and confidentiality of data (Article 5(1)(f) of the GDPR): The authority found that the company had not implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The investigation revealed several critical failures: the data stored on the affected system was not encrypted at rest, and no active monitoring or audit tools were in place, which prevented proactive detection of the intrusion. The breach was only discovered after the stolen data was published on the deep web. The authority qualified these failures as serious negligence, emphasizing that the compromised system had not been properly integrated and secured after the company's acquisition by the LIDER IT group, leaving it without standard security measures.

Authority's decision

Consequently, the authority imposed a €3,000 fine on COINSOFT 21, S.L. The initial amount of €5,000 was reduced by 40% following the company's acknowledgment of responsibility and voluntary payment.

Furthermore, the authority ordered the company to adopt the necessary corrective measures to comply with the regulation and to prove their effective implementation within one month.

Lessons learned

This decision reminds that:

• The absence of encryption of data at rest constitutes a major vulnerability which, in case of intrusion, facilitates the exfiltration and exploitation of data, characterizing a failure to comply with the security obligation.
• When acquiring a company or integrating new information systems, particular diligence must be applied to ensure that the acquiring group's security policies and measures are properly implemented and audited.
• The detection of a data breach by a third party following the publication of compromised information, and not by internal monitoring tools, demonstrates insufficient resilience and system monitoring measures.