[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOitywgJIlFatay5aWaa7EzJYzxckR8s1fwBN66jefbs":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"131b2d06-3592-485f-80f5-7043e847ea32","AEPD (Spain) - PS-00020-2025","aepd-spain-ps-00020-2025-6fb07c","← Older revision Revision as of 08:14, 8 July 2026 Line 65: Line 65: }} }} The DPA fined a controller €200,000 after a ransomware breach exposed data of around 40,000 people and found insufficient security measures and failure to carry out a DPIA. The DPA fined an insurance broker €200,000 after a ransomware attack exposed data of around 40,000 people. The DPA found that the broker implemented insufficient security measures and failed to carry out a DPIA. == English Summary == == English Summary ==","Spain's AEPD has fined an insurance broker €200,000 following a ransomware attack that exposed the data of approximately 40,000 individuals. The agency found that the broker had insufficient security measures in place and failed to conduct a Data Protection Impact Assessment (DPIA), violating GDPR principles.","Spain's AEPD fines insurance broker €200K for ransomware breach and insufficient security.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00020-2025&diff=52111&oldid=52091","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-07-08T08:14:13+00:00","2026-07-08T10:00:19.458969+00:00",7,[17,20,23],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"ransomware","product",{"name":24,"type":22},"Alkora S.A.U.","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":25,"icon":27,"name":28,"slug":21},null,"Ransomware",[30,35,40,45],{"category":31},{"id":32,"icon":27,"name":33,"slug":34},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":36},{"id":37,"icon":27,"name":38,"slug":39},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":41},{"id":42,"icon":27,"name":43,"slug":44},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":46},{"id":25,"icon":27,"name":28,"slug":21},[],[18,24],{"controls":50,"vendors":123},[51,80,94],{"slug":52,"name":53,"problem":54,"products":55},"patch-management","Automated patch management","Known holes get closed in days, not months.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[85,86],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":95,"name":96,"problem":97,"products":98},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":142},"spanish-insurer-fined-200k-after-ransomware-exposes-40000-records-and-dpia-failures","Spanish Insurer Fined €200K After Ransomware Exposes 40,000 Records and DPIA Failures","An insurance broker suffered a ransomware attack that compromised the personal data of approximately 40,000 individuals, resulting in a €200,000 fine from Spain's data protection authority, the AEPD. The root cause was a combination of inadequate technical security controls and a failure to perform a mandatory Data Protection Impact Assessment (DPIA) before processing high-risk personal data. DPIAs are a critical GDPR requirement that force organisations to proactively identify and mitigate privacy risks — skipping this step left significant vulnerabilities undetected and unaddressed. This case underscores that GDPR compliance is not a paper exercise; regulators expect organisations handling sensitive data at scale to implement layered technical defences commensurate with the risk. Financial penalties and reputational damage are the direct consequence of treating data protection obligations as optional.",[129,130,131,132,133,134,135,136,137,138,139,140,141],"GDPR Article 5(1)(f) — Integrity and Confidentiality","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 32 — Security of Processing","GDPR Article 33 — Notification of a Personal Data Breach","GDPR Article 35 — Data Protection Impact Assessment","NIST CSF ID.RA-1 — Asset Vulnerabilities Identified","NIST CSF PR.IP-12 — Vulnerability Management Plan","NIST SP 800-30 — Risk Assessment Guide","CIS Control 7 — Continuous Vulnerability Management","CIS Control 13 — Network Monitoring and Defence","CIS Control 17 — Incident Response Management","ISO\u002FIEC 27001:2022 Annex A.8.8 — Management of Technical Vulnerabilities","ISO\u002FIEC 27001:2022 Annex A.5.29 — Information Security During Disruption",{}]