DPC (Ireland) - IN-22-7-3

Permanent TSB failed to implement sufficient identity verification controls at its Open24 Contact Centre, allowing malicious actors to impersonate customers and gain unauthorized access to sensitive financial accounts. The root cause was a combination of weak authentication procedures and inadequate staff training to detect and resist social engineering attempts. This incident demonstrates that technical security controls must be complemented by robust human-layer defenses, particularly in customer-facing roles where verbal or remote authentication is common. Compounding the breach, PTSB's delayed notification to the DPC violated GDPR Article 33 requirements, resulting in additional regulatory liability. Financial institutions must treat timely breach reporting as a non-negotiable compliance obligation, not an afterthought.