[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsiMaJ3jzP2SYOLA5FATmophHTWUwC50K0qW8B5_UCEY":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":119},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"d088a981-e50e-4aeb-a247-7c974501417d","VDAI (Lithuania) - 3R-1143","vdai-lithuania-3r-1143-eddb9d","← Older revision Revision as of 09:24, 8 July 2026 (One intermediate revision by the same user not shown) Line 69: Line 69: === Holding === === Holding === The DPA imposed a fine of €450,000 on the legal successor of one of the controllers. It held that the controllers had failed to implement appropriate technical and organisational measures to ensure the security of processing and compliance with the principles of integrity and confidentiality. The controller had violated Articles 5(1)(f), 24(1), and 32(1)(b) GDPR. The DPA imposed a fine of €450,000 on the first controller it investigated as this company was also the legal successor of the other controller. It held that the controllers had failed to implement appropriate technical and organisational measures to ensure the security of processing and compliance with the principles of integrity and confidentiality. The controller had violated Articles 5(1)(f), 24(1), and 32(1)(b) GDPR. When assessing the GDPR infringements, the DPA took into account that the controllers processed sensitive categories of personal data. The DPA held the controllers lacked adequate security measures for protecting against unauthorised access to an IT system, such as access control and authentication. For instance, passwords used by employees did not reach a certain level of complexity, and multi-factor authentication was not used. When assessing the GDPR infringements, the DPA took into account that the controllers processed sensitive categories of personal data. The DPA held the controllers lacked adequate security measures for protecting against unauthorised access to an IT system, such as access control and authentication. For instance, passwords used by employees did not reach a certain level of complexity, and multi-factor authentication was not used.","Lithuania's Data Protection Authority (VDAI) has fined a medical company €450,000 for failing to implement appropriate technical and organizational measures to ensure data security. The breaches, which affected sensitive health data and personal information of approximately 383,000 individuals, were attributed to inadequate access controls and weak password complexity, with no multi-factor authentication in place.","Lithuanian DPA fines medical company €450K for inadequate data security measures.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VDAI_(Lithuania)_-_3R-1143&diff=52116&oldid=52106",null,"2026-07-08T09:24:51+00:00","2026-07-08T10:00:19.458969+00:00",7,[17],{"name":18,"type":19},"VDAI","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":12,"name":22,"slug":23},"GDPR","gdpr",[25,27,32,37],{"category":26},{"id":20,"icon":12,"name":22,"slug":23},{"category":28},{"id":29,"icon":12,"name":30,"slug":31},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":45,"vendors":118},[46,75,97],{"slug":47,"name":48,"problem":49,"products":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":76,"name":77,"problem":78,"products":79},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},{"slug":98,"name":99,"problem":100,"products":101},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[102,110],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[],{"slug":120,"title":121,"body":122,"framework_refs":123,"framework_notes":135},"lithuanian-medical-firm-fined-450k-for-weak-access-controls-exposing-383000-health-records","Lithuanian Medical Firm Fined €450K for Weak Access Controls Exposing 383,000 Health Records","A Lithuanian medical company failed to implement adequate technical and organizational safeguards, leaving sensitive health data of nearly 383,000 individuals exposed due to weak password policies and the absence of multi-factor authentication. Under GDPR Article 32, organizations processing sensitive personal data — especially health records — are legally obligated to apply appropriate security measures proportionate to the risk. The lack of basic access control hygiene demonstrates that compliance is not merely a checkbox exercise but requires continuous, enforceable security standards. This case highlights how foundational security failures in healthcare environments can result in both massive regulatory penalties and profound harm to data subjects whose most sensitive information is compromised.",[124,125,126,127,128,129,130,131,132,133,134],"GDPR Article 32 – Security of Processing","GDPR Article 5(1)(f) – Integrity and Confidentiality Principle","GDPR Article 83(4) – Administrative Fines","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 IA-2 – Multi-Factor Authentication","NIST SP 800-63B – Digital Identity Guidelines (MFA)","ISO\u002FIEC 27001:2022 – A.5.15 Access Control","ISO\u002FIEC 27001:2022 – A.5.17 Authentication Information",{}]