ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026
Orange Romania fined €100,000 for GDPR violations leading to data breach.
Orange Romania has been fined €100,000 by the Romanian DPA for failing to implement adequate technical and organizational safeguards. The violations, stemming from a data breach where customer invoices were accessed and a subsequent cyberattack on a ticketing application, led to the unauthorized disclosure of sensitive personal data. The company was ordered to enhance its IT application monitoring and vulnerability testing processes.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Orange?
Get an email when a new story names Orange, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOrange Romania was fined €100,000 by the Romanian DPA (ANSPDCP) after two distinct security failures: unauthorized access to customer invoices and a cyberattack exploiting a ticketing application. The root cause was the absence of adequate technical and organizational safeguards, specifically insufficient vulnerability testing and weak IT application monitoring. These gaps allowed attackers to access and disclose sensitive personal data without timely detection or intervention. Under GDPR, organizations are obligated to implement appropriate security measures proportionate to the risk, and failing to do so carries significant financial and reputational consequences. This case underscores that reactive security postures are insufficient — continuous monitoring and proactive vulnerability management are regulatory requirements, not optional best practices.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.