[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmTxCqSxMNKz5EL-RvzZskNDILHUZ55HhtpXiD3rDMrY":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"97adc7e7-8b1a-4d61-a0d2-004bc95f2fdd","ANSPDCP (Romania) - ANSPDCP (Romania) - Fine against Poliserv JG (PJG) SRL","anspdcp-romania-anspdcp-romania-fine-against-poliserv-jg-pjg-srl-574cfc","Cerasela moved page ANSPDCP (Romania) - ANSPDCP (Romania) - Fine against Poliserv JG (PJG) SRL to ANSPDCP (Romania) - Fine against Poliserv JG (PJG) SRL Misspelled title ← Older revision Revision as of 10:38, 21 August 2026 (2 intermediate revisions by the same user not shown) Line 7: Line 7: |DPA_With_Country=ANSPDCP (Romania) |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=ANSPDCP (Romania) - Fine against Poliserv JG (PJG) SRL |Case_Number_Name=Fine against Poliserv JG (PJG) SRL |ECLI= |ECLI= Line 88: Line 88: }} }} The Romanian DPA imposed a fine of RON 15,728 (€ 3,000) on a car dealer for failing to implement appropriate technical and organisational measures in order to guarantee the security of its processing, in breach of [[Article 32 GDPR|Article 32 GDPR]]. The Romanian DPA imposed a fine of RON 15,728 (€3,000) on a car dealer for failing to implement appropriate technical and organisational measures in order to guarantee the security of its processing, in breach of [[Article 32 GDPR]]. == English Summary == == English Summary == Line 97: Line 97: === Holding === === Holding === ANSPDCP found that the controller infringed Article 32(1)(b) and [[Article 32 GDPR|Article 32(2) GDPR]] by failing to implement adequate technical and organisational measures to ensure the security of personal data processing. Considering that a phishing attack compromised an administrator account and enabled unauthorised access to customers' personal data, the controller's security measures and testing procedures were not appropriate for maintaining the continuity of confidentiality, integrity, availability and resilience of processing systems and services. ANSPDCP found that the controller infringed Article 32(1)(b) GDPR and [[Article 32 GDPR|Article 32(2) GDPR]] by failing to implement adequate technical and organisational measures to ensure the security of personal data processing. Considering that a phishing attack compromised an administrator account and enabled unauthorised access to customers' personal data, the controller's security measures and testing procedures were not appropriate for maintaining the ongoing confidentiality, integrity, availability and resilience of processing systems and services. In addition, as a corrective measure, pursuant to Article 58 (2) GDPR, the DPA ordered the controller to periodically verify compliance with its data protection and information security procedures and provide regular phishing-awareness training to its personnel working with personal data. In addition, as a corrective measure, pursuant to Article 58(2)(d) GDPR, the DPA ordered the controller to periodically verify compliance with its data protection and information security procedures and provide regular phishing-awareness training to its personnel working with personal data. Finally, for these violations, ANSPDCP decided to fine the controller €3,000 (RON 15,728). Finally, for these violations, ANSPDCP decided to fine the controller €3,000 (RON 15,728).","The Romanian Data Protection Authority (ANSPDCP) has fined Poliserv JG (PJG) SRL, a car dealership, €3,000 (RON 15,728) for failing to implement adequate technical and organizational measures to secure personal data processing. The fine was issued after a phishing attack compromised an administrator account, leading to unauthorized access to customer data, violating Article 32 of the GDPR. The DPA also mandated regular phishing awareness training and verification of data protection procedures.","Romanian DPA fines car dealer €3,000 for data security failures after phishing attack.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_ANSPDCP_(Romania)_-_Fine_against_Poliserv_JG_(PJG)_SRL&diff=52745&oldid=52742","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-08-21T10:38:46+00:00","2026-08-21T12:00:19.155558+00:00",7,[17,20],{"name":18,"type":19},"ANSPDCP","vendor",{"name":21,"type":22},"Poliserv JG (PJG) SRL","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":133},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":80,"name":81,"problem":82,"products":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":109,"name":110,"problem":111,"products":112},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[113,120,126],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":109,"product_name":117,"url":118,"description":119},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":149},"phishing-attack-on-car-dealership-leads-to-gdpr-fine-for-inadequate-security-measures","Phishing Attack on Car Dealership Leads to GDPR Fine for Inadequate Security Measures","A phishing attack successfully compromised an administrator account at Poliserv JG (PJG) SRL, exposing customer personal data and triggering a €3,000 GDPR fine from Romania's data protection authority. The root cause was a failure to implement adequate technical and organizational measures, as required by GDPR Article 32, including insufficient phishing awareness training and weak account protection. Administrator accounts are high-value targets and require layered defenses such as multi-factor authentication and regular security training. This case demonstrates that even smaller businesses handling customer data are held to GDPR standards, and negligence in basic security hygiene carries both financial and reputational consequences.",[139,140,141,142,143,144,145,146,147,148],"GDPR Article 32 – Security of Processing","GDPR Article 83 – Administrative Fines","CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management","NIST Cybersecurity Framework PR.AT-1 – Awareness and Training","ISO\u002FIEC 27001:2022 A.6.3 – Information Security Awareness, Education and Training",{}]