Curtea Veche Publishing SRL

Description

The Romanian DPA has imposed a fine of EUR 5,000 on Curtea Veche Publishing SRL. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR. In the first data breach, the controller had inadvertently published a file containing the customer database in a public forum. This resulted in the unauthorized disclosure of personal data such as first name, last name, phone number, email, password in encrypted form and IP address of 10,793 customers. The second data breach concerned a ransomware attack that resulted in unauthorized access and loss of integrity as well as availability of personal data of about 100 data subjects. During its investigation, the DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data. This failure to implement protective measures permitted the data breaches to occur.