[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcp1NiHgDXwimBENkP2uSzOkPhZk9qgjJVqLP0DdlwRs":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"e4ac9003-15be-444d-9f4a-ebbf601951fe","ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026","anspdcp-romania-fine-against-orange-romania-sa-of-july-17-2026-5acd3e","← Older revision Revision as of 12:06, 28 July 2026 Line 69: Line 69: }} }} The DPA fined RON 523,900 (€100,000) a telecom company for breaching Article 25 GDPR and Article 32 GDPR by failing to implement adequate technical and organizational safeguards and ensure the security of personal data processing. The DPA fined RON 523,900 (€100,000) a telecom company for breaching Article 25 GDPR and Article 32 GDPR by failing to implement adequate technical and organisational safeguards and ensure the security of personal data processing. == English Summary == == English Summary ==","Romania's ANSPDCP (data protection authority) fined Orange Romania SA €100,000 (RON 523,900) on July 17, 2026, for breaching GDPR Articles 25 and 32 by failing to implement adequate technical and organizational security measures. The violations were identified after a data breach where customers could access other customers' invoices and personal data due to application misconfigurations, and a publicly accessible ticketing platform lacking VPN, MFA, and IP restrictions was exploited to steal customer data including names, IDs, banking info, and credentials.","Romania's DPA fines Orange Romania €100K for inadequate data security safeguards under GDPR Articles 25 and 32.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_Fine_against_Orange_Romania_SA_of_July_17,_2026&diff=52515&oldid=52446","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-07-28T12:06:19+00:00","2026-07-28T14:00:07.957551+00:00",7,[17,20],{"name":18,"type":19},"Orange Romania SA","vendor",{"name":21,"type":19},"ANSPDCP","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":22,"icon":24,"name":25,"slug":26},null,"GDPR","gdpr",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":46,"vendors":126},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":77,"name":78,"problem":79,"products":80},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[110,118],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":144},"orange-romania-fined-100k-after-app-misconfigurations-expose-customer-data","Orange Romania Fined €100K After App Misconfigurations Expose Customer Data","Orange Romania was fined €100,000 by Romania's data protection authority after application misconfigurations allowed customers to view other customers' invoices and personal data, while a publicly accessible ticketing platform with no VPN, MFA, or IP restrictions was exploited to steal sensitive customer information including banking details and credentials. The root cause lies in inadequate technical and organizational security measures, violating GDPR Articles 25 (Data Protection by Design and by Default) and 32 (Security of Processing). This case illustrates that misconfigured applications and unprotected internal platforms are not just technical oversights — they are regulatory violations carrying significant financial and reputational consequences. Organizations handling personal data must treat access controls and secure configuration as baseline compliance requirements, not optional hardening steps.",[132,133,134,135,136,137,138,139,140,141,142,143],"GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 32 – Security of Processing","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 CM-6 – Configuration Settings","NIST SP 800-53 IA-2 – Identification and Authentication (MFA)","NIST SP 800-53 SC-7 – Boundary Protection","OWASP API Security Top 10 – API1:2023 Broken Object Level Authorization (BOLA)","ISO\u002FIEC 27001:2022 – A.8.3 Information Access Restriction","ISO\u002FIEC 27001:2022 – A.8.9 Configuration Management",{}]