[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVviDSpuC0VTszyAvZyfLTNpbu_Qi3rJicikRlw8xTlk":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"73bc785a-fc45-4239-a784-cbe34558404f","DPC (Ireland) - IN-22-7-3","dpc-ireland-in-22-7-3-acdddf","← Older revision Revision as of 13:59, 6 July 2026 (One intermediate revision by the same user not shown) Line 21: Line 21: |Type=Investigation |Type=Investigation |Outcome=Violation Found |Outcome=Violation Found |Date_Started= |Date_Started=26.05.2022 |Date_Decided= |Date_Decided=30.04.2026 |Date_Published= |Date_Published= |Year= |Year= Line 72: Line 72: === Facts === === Facts === PTSB, the controller, is a provider of banking services in Ireland. Its Open24 Contact Centre allows customers to access their accounts and perform banking operations by telephone. Permanent TSB Group, the controller, is a provider of banking services in Ireland. Its Open24 Contact Centre allows customers to access their accounts and perform banking operations by telephone. On 26 and 27 May 2022, the controller submitted three personal data breach notifications to the Data Protection Commission, the DPA. The breaches concerned social engineering attacks carried out between April and May 2022. Malicious actors contacted the controller’s call centre while impersonating three customers. On 26 and 27 May 2022, the controller submitted three personal data breach notifications to the Data Protection Commission, the DPA. The breaches concerned social engineering attacks carried out between April and May 2022. Malicious actors contacted the controller’s call centre while impersonating three customers. Line 84: Line 84: === Holding === === Holding === The DPA held that the controller infringed Articles 5(1)(f) and 32(1) GDPR. The DPA held that the controller infringed [[Article 5 GDPR|Articles 5(1)(f)]] and [[Article 32 GDPR|32(1) GDPR]]. The processing carried out through the Open24 Contact Centre involved large quantities of sensitive personal and financial data. Unauthorised access could result in identity theft, loss of control over personal data, account takeover and financial loss. The likelihood and severity of these risks were therefore high. The processing carried out through the Open24 Contact Centre involved large quantities of sensitive personal and financial data. Unauthorised access could result in identity theft, loss of control over personal data, account takeover and financial loss. The likelihood and severity of these risks were therefore high. Line 90: Line 90: Although the controller had identified several relevant risks and had implemented certain security measures, these measures did not ensure a level of security appropriate to the risk. In particular, the controller had not implemented sufficient technical controls to prevent foreseeable human error or repeated social engineering attacks. Although the controller had identified several relevant risks and had implemented certain security measures, these measures did not ensure a level of security appropriate to the risk. In particular, the controller had not implemented sufficient technical controls to prevent foreseeable human error or repeated social engineering attacks. Call centre agents could change mobile telephone numbers and other important account details without mandatory backend validation confirming that the required security checks had been completed. The controller did not adequately log unsuccessful account-access attempts, alert agents to previous suspicious calls or require additional verification before significant changes were made to an account. Call centre agents could change mobile telephone numbers and other important account details without mandatory back-end validation confirming that the required security checks had been completed. The controller did not adequately log unsuccessful account-access attempts, alert agents to previous suspicious calls or require additional verification before significant changes were made to an account. The DPA also identified deficiencies in the controller’s organisational measures. There was no adequate procedure for alerting a manager or placing a warning on an account following unsuccessful attempts to access or change account information. This allowed malicious actors to contact multiple agents and gradually obtain the information necessary to take control of accounts. The DPA also identified deficiencies in the controller’s organisational measures. There was no adequate procedure for alerting a manager or placing a warning on an account following unsuccessful attempts to access or change account information. This allowed malicious actors to contact multiple agents and gradually obtain the information necessary to take control of accounts. The controller’s initial training was also insufficient. New agents received limited practical testing and were only required to pass one simulated call before handling customer calls. The DPA considered this inadequate given the sensitivity of the data, the complexity of the security procedures and the foreseeable risk of social engineering. Monitoring of calls and compliance with security procedures was similarly insufficient. The controller’s initial training was also insufficient. New agents received limited practical testing and were only required to pass one simulated call before handling customer calls. The DPA considered this inadequate given the sensitivity of the data, the complexity of the security procedures and the foreseeable risk of social engineering. Monitoring of calls and compliance with security procedures was similarly insufficient. The DPA clarified that Articles 5(1)(f) and 32(1) GDPR do not impose strict liability or require controllers to eliminate every possible risk. However, controllers must objectively assess the likelihood and severity of the risks and implement effective measures appropriate to those risks. In this case, the occurrence of several similar breaches involving repeated failures by different agents demonstrated that the measures were not effective. The DPA clarified that [[Article 5 GDPR|Articles 5(1)(f)]] and [[Article 32 GDPR|32(1) GDPR]] do not impose strict liability or require controllers to eliminate every possible risk. However, controllers must objectively assess the likelihood and severity of the risks and implement effective measures appropriate to those risks. In this case, the occurrence of several similar breaches involving repeated failures by different agents demonstrated that the measures were not effective. The DPA further held that the controller infringed [[Article 33 GDPR#1|Article 33(1) GDPR]] by failing to notify the three breaches without undue delay. The DPA further held that the controller infringed [[Article 33 GDPR#1|Article 33(1) GDPR]] by failing to notify the three breaches without undue delay. The controller delayed involving its data protection team while its fraud team investigated the incidents. It argued that time was needed to review calls and establish whether personal data breaches had occurred. The DPA rejected this reasoning. A controller must have procedures that allow it to identify potential personal data breaches promptly and cannot suspend its assessment until a separate fraud investigation has been completed. The controller delayed involving its data protection team while its fraud team investigated the incidents. It argued that time was needed to review calls and establish whether personal data breaches had occurred. The DPA rejected this reasoning. A controller must have procedures that allow it to identify potential personal data breaches promptly and cannot suspend its assessment until a separate fraud investigation has been completed. The DPA also found that, after the data protection team became aware of the incidents, there were no circumstances justifying further delays beyond the 72-hour notification period. The fact that the controller had secured the affected accounts and refunded the financial losses did not remove its obligation to notify the DPA without undue delay. The DPA also found that, after the data protection team became aware of the incidents, there were no circumstances justifying further delays beyond the 72-hour notification period. The fact that the controller had secured the affected accounts and refunded the financial losses did not remove its obligation to notify the DPA without undue delay. Line 104: Line 102: The DPA considered the infringements negligent. The controller was aware of the risks associated with external fraud, human error and non-compliance with call centre procedures but failed to implement sufficiently effective controls. The DPA nevertheless took into account the controller’s remedial measures, cooperation, refunds to the affected data subjects and absence of relevant previous infringements. The DPA considered the infringements negligent. The controller was aware of the risks associated with external fraud, human error and non-compliance with call centre procedures but failed to implement sufficiently effective controls. The DPA nevertheless took into account the controller’s remedial measures, cooperation, refunds to the affected data subjects and absence of relevant previous infringements. The DPA issued a reprimand under [[Article 58 GDPR#2b|Article 58(2)(b) GDPR]] for the infringements of Articles 5(1)(f), 32(1) and 33(1) GDPR. The DPA issued a reprimand under [[Article 58 GDPR#2b|Article 58(2)(b) GDPR]] and imposed an administrative fine of €250,000 for the infringements of [[Article 5 GDPR|Articles 5(1)(f)]] and [[Article 32 GDPR|32(1) GDPR]] and a separate fine of €27,500 for the infringement of [[Article 33 GDPR#1|Article 33(1) GDPR]]. The total fine was therefore €277,500. It imposed an administrative fine of €250,000 for the infringements of Articles 5(1)(f) and 32(1) GDPR and a separate fine of €27,500 for the infringement of [[Article 33 GDPR#1|Article 33(1) GDPR]]. The total fine was therefore €277,500. The DPA did not issue an order to bring the processing into compliance under [[Article 58 GDPR#2d|Article 58(2)(d) GDPR]] because the controller had already implemented ongoing remedial measures following the breaches. The DPA did not issue an order to bring the processing into compliance under [[Article 58 GDPR#2d|Article 58(2)(d) GDPR]] because the controller had already implemented ongoing remedial measures following the breaches.","The Irish Data Protection Commission (DPC) has fined Permanent TSB (PTSB) €277,500 for multiple GDPR violations. The breaches stemmed from social engineering attacks where malicious actors impersonated customers to gain unauthorized access to accounts via PTSB's Open24 Contact Centre. The DPC found that PTSB failed to implement adequate technical and organizational measures to secure sensitive personal and financial data, and also violated notification requirements by delaying reporting the breaches.","Irish DPC fines PTSB €277,500 for GDPR violations following social engineering attacks.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DPC_(Ireland)_-_IN-22-7-3&diff=52071&oldid=52069","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F82\u002FLogoIE.png","2026-07-06T13:59:44+00:00","2026-07-06T14:00:24.449162+00:00",7,[17],{"name":18,"type":19},"PTSB","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":128},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":77,"name":78,"problem":79,"products":80},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,116,121],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":117,"product_name":118,"url":119,"description":120},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":106,"product_name":125,"url":126,"description":127},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":147},"ptsb-fined-277500-after-social-engineering-attacks-bypass-contact-centre-authentication","PTSB Fined €277,500 After Social Engineering Attacks Bypass Contact Centre Authentication","Permanent TSB failed to implement sufficient identity verification controls at its Open24 Contact Centre, allowing malicious actors to impersonate customers and gain unauthorized access to sensitive financial accounts. The root cause was a combination of weak authentication procedures and inadequate staff training to detect and resist social engineering attempts. This incident demonstrates that technical security controls must be complemented by robust human-layer defenses, particularly in customer-facing roles where verbal or remote authentication is common. Compounding the breach, PTSB's delayed notification to the DPC violated GDPR Article 33 requirements, resulting in additional regulatory liability. Financial institutions must treat timely breach reporting as a non-negotiable compliance obligation, not an afterthought.",[134,135,136,137,138,139,140,141,142,143,144,145,146],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","NIST SP 800-53 IA-2 – Identification and Authentication","NIST SP 800-53 AT-2 – Security Awareness Training","NIST SP 800-53 IR-6 – Incident Reporting","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001:2022 A.6.1 – Screening and awareness","ISO\u002FIEC 27001:2022 A.8.2 – Privileged access rights","ITIL 4 – Incident Management Practice",{}]