[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2VXrtOonVnlmnu55HVcIiRDRcVVHiwwbL6Vzyz97uJM":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"beef9fb0-5072-4dd2-a0a7-9e8d286ab5c9","Data breach: the CNIL fined MOBIUS SOLUTIONS LTD €1 million","data-breach-the-cnil-fined-mobius-solutions-ltd-1-million-b91e23","Data breach: the CNIL fined MOBIUS SOLUTIONS LTD €1 million ipayotfr Fri, 21\u002F08\u002F2026 - 10:54","The CNIL has fined Mobius Solutions Ltd €1 million for multiple GDPR violations following a data breach reported by Deezer. Mobius Solutions, a former processor for Deezer, unlawfully retained data of over 46 million users after their contract ended and used this data without authorization to improve its own services. These actions constituted breaches of processor obligations under GDPR Articles 28 and 29, as well as Article 30 regarding record-keeping.","CNIL fines Mobius Solutions Ltd €1 million for GDPR violations after data breach.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fdata-breach-the-cnil-fined-mobius-solutions-ltd-eur1-million_en",null,"2026-08-21T08:54:25+00:00","2026-08-21T10:00:13.296179+00:00",7,[17,20,22],{"name":18,"type":19},"MOBIUS SOLUTIONS LTD","vendor",{"name":21,"type":19},"DEEZER",{"name":23,"type":24},"personalized advertising campaigns","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":12,"name":27,"slug":28},"Policy","policy",[30,35,40,42],{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":41},{"id":25,"icon":12,"name":27,"slug":28},{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21,23],{"controls":50,"vendors":135},[51,80,106],{"slug":52,"name":53,"problem":54,"products":55},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":81,"name":82,"problem":83,"products":84},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[85,93,98],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":94,"product_name":95,"url":96,"description":97},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":107,"name":108,"problem":109,"products":110},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":151},"ex-processor-retains-46m-user-records-after-contract-ends-fined-1m","Ex-Processor Retains 46M User Records After Contract Ends, Fined €1M","Mobius Solutions unlawfully retained and exploited personal data belonging to over 46 million Deezer users after their data processing agreement had concluded, directly violating GDPR Articles 28, 29, and 30. This case highlights a critical blind spot in third-party data governance: organizations often lack mechanisms to verify that processors actually delete or return data once a contract ends. The unauthorized use of retained data to improve Mobius's own services compounded the breach, transforming a retention failure into active misuse. This matters because organizations remain accountable for the data they share with processors, even after the relationship ends, making vendor lifecycle management a core privacy responsibility.",[141,142,143,144,145,146,147,148,149,150],"GDPR Article 28 (Processor obligations)","GDPR Article 29 (Processing under controller\u002Fprocessor authority)","GDPR Article 30 (Records of processing activities)","GDPR Article 5(1)(e) (Storage limitation principle)","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 AC-23 (Data Mining Protection)","CIS Control 3.14 (Log Sensitive Data Access)","CIS Control 15 (Service Provider Management)","ISO 27001 Annex A 5.19 (Information security in supplier relationships)","ISO 27001 Annex A 5.20 (Addressing security within supplier agreements)",{}]