[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvg9kP5KFcZEzm66lf5hT7hNKQaIUzJDWglmdwiGy-Ig":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"794972dc-37d6-4380-9c97-ae56aebf9cd1","Datatilsynet (Denmark) - 2021-441-9489","datatilsynet-denmark-2021-441-9489-8407d1","Standardized name and link ← Older revision Revision as of 07:24, 17 July 2026 Line 35: Line 35: |GDPR_Article_Link_3= |GDPR_Article_Link_3= |EU_Law_Name_1=Directive 2016\u002F679 |EU_Law_Name_1= |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679&from=DA |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Name_2= |EU_Law_Link_2= |EU_Law_Link_2=","Datatilsynet (Denmark's DPA) issued a reprimand to Designbysi, a fashion brand, for violating Article 32(1) GDPR by failing to implement adequate technical and organizational security measures. Hackers injected malicious JavaScript code into the website between April–June 2021, stealing customer payment card information. The DPA specifically found that Designbysi lacked two-factor authentication for staff with access to critical website scripts, enabling the breach.","Danish DPA reprimanded fashion brand Designbysi for insufficient security measures enabling payment card theft.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Denmark)_-_2021-441-9489&diff=52299&oldid=26898","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fb\u002Fb2\u002FLogoDK.png","2026-07-17T07:24:00+00:00","2026-07-17T08:00:11.278983+00:00",7,[17,20],{"name":18,"type":19},"Designbysi","vendor",{"name":21,"type":19},"Datatilsynet","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":22,"icon":24,"name":25,"slug":26},null,"GDPR","gdpr",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[44],{"type":45,"value":46,"context":47},"malware","Malicious JavaScript code injection","Attackers injected JavaScript into Designbysi's website to steal payment card data from customers during checkout between 26 April 2021 and 22 June 2021.",[18,21],{"controls":50,"vendors":127},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":81,"name":82,"problem":83,"products":84},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[114,119],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":115,"product_name":116,"url":117,"description":118},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":145},"missing-mfa-on-admin-accounts-led-to-payment-card-skimming-at-danish-fashion-brand","Missing MFA on Admin Accounts Led to Payment Card Skimming at Danish Fashion Brand","Hackers injected malicious JavaScript (a 'Magecart'-style attack) into Designbysi's website over a three-month period, silently stealing customer payment card data at checkout. The Danish DPA found the root cause was the absence of two-factor authentication for staff accounts with access to critical website scripts, meaning a single compromised credential was enough to introduce the malicious code. This violates GDPR Article 32(1), which requires organisations to implement appropriate technical and organisational measures commensurate with the risk — and payment data is unambiguously high-risk. The case illustrates that failing to apply basic access controls to privileged functions is not just a technical shortcoming but a legal liability under European data protection law.",[133,134,135,136,137,138,139,140,141,142,143,144],"GDPR Article 32(1) — Appropriate technical and organisational security measures","GDPR Article 32(2) — Risk-based assessment including accidental or unlawful access","CIS Control 4 — Secure Configuration of Enterprise Assets and Software","CIS Control 6 — Access Control Management (MFA requirement)","CIS Control 16 — Application Software Security","NIST SP 800-53 AC-2 — Account Management","NIST SP 800-53 AC-17 — Remote Access (MFA enforcement)","NIST SP 800-53 SI-7 — Software, Firmware, and Information Integrity","NIST SP 800-53 IA-2 — Identification and Authentication (Multi-Factor)","PCI DSS Requirement 6.4 — Protection of public-facing web applications","PCI DSS Requirement 8.4 — Multi-factor authentication for all access into the cardholder data environment","OWASP Top 10 A08:2021 — Software and Data Integrity Failures",{}]