ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026
Romania's DPA fines Orange Romania €100K for inadequate data security safeguards under GDPR Articles 25 and 32.
Romania's ANSPDCP (data protection authority) fined Orange Romania SA €100,000 (RON 523,900) on July 17, 2026, for breaching GDPR Articles 25 and 32 by failing to implement adequate technical and organizational security measures. The violations were identified after a data breach where customers could access other customers' invoices and personal data due to application misconfigurations, and a publicly accessible ticketing platform lacking VPN, MFA, and IP restrictions was exploited to steal customer data including names, IDs, banking info, and credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Orange Romania SA?
Get an email when a new story names Orange Romania SA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOrange Romania was fined €100,000 by Romania's data protection authority after application misconfigurations allowed customers to view other customers' invoices and personal data, while a publicly accessible ticketing platform with no VPN, MFA, or IP restrictions was exploited to steal sensitive customer information including banking details and credentials. The root cause lies in inadequate technical and organizational security measures, violating GDPR Articles 25 (Data Protection by Design and by Default) and 32 (Security of Processing). This case illustrates that misconfigured applications and unprotected internal platforms are not just technical oversights — they are regulatory violations carrying significant financial and reputational consequences. Organizations handling personal data must treat access controls and secure configuration as baseline compliance requirements, not optional hardening steps.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.