UODO (Poland) - DKN.5131.34.2023
Poland's UODO fines accounting firm €2,760 for data breach due to inadequate security.
Poland's data protection authority (UODO) has fined an accounting and tax consulting company €2,760 for failing to implement adequate technical and organizational measures following a data breach. The breach involved unauthorized access to an employee's email account, exposing sensitive personal data of clients and their families. The DPA ruled that mere unauthorized access constitutes a data breach and that the company's security measures were insufficient, only being implemented after the breach was reported.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonAn accounting and tax consulting firm in Poland was fined €2,760 by UODO after an unauthorized party gained access to an employee's email account, exposing sensitive personal data belonging to clients and their families. The core failure was the absence of adequate technical and organizational security measures — such as multi-factor authentication and proper access controls — prior to the breach occurring. Critically, the DPA ruled that the mere act of unauthorized access constitutes a reportable data breach, regardless of whether data was exfiltrated or misused. The company's reactive approach — only tightening security after the breach was reported — demonstrated a lack of proactive GDPR compliance. This case underscores that organizations handling sensitive financial and personal data have a legal obligation to implement proportionate safeguards before incidents occur, not in response to them.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.