Datatilsynet (Denmark) - 2021-441-9489

Hackers injected malicious JavaScript (a 'Magecart'-style attack) into Designbysi's website over a three-month period, silently stealing customer payment card data at checkout. The Danish DPA found the root cause was the absence of two-factor authentication for staff accounts with access to critical website scripts, meaning a single compromised credential was enough to introduce the malicious code. This violates GDPR Article 32(1), which requires organisations to implement appropriate technical and organisational measures commensurate with the risk — and payment data is unambiguously high-risk. The case illustrates that failing to apply basic access controls to privileged functions is not just a technical shortcoming but a legal liability under European data protection law.