[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fer1cZWx-Y1qEK6YEvU1b-tNJwRpCgfmNt7E9eqcdn8Q":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"985b85fc-ca07-40e6-b289-b99021971c3b","insurance-broker-fined-200k-after-ransomware-exposes-40000-records-and-missing-dpia","a1ac3ea9-55bc-4c22-aa96-f1a2ee2f2820","Insurance Broker Fined €200K After Ransomware Exposes 40,000 Records and Missing DPIA","Alkora S.A.U. failed to implement adequate technical and organisational security measures despite being aware of extreme cybercrime risks to its IT environment, resulting in a ransomware attack that compromised personal data of approximately 40,000 individuals. The AEPD found a direct violation of GDPR Article 5(1)(f), the integrity and confidentiality principle, underscoring that awareness of risk without action is itself a compliance failure. Critically, the company also neglected to conduct a mandatory Data Protection Impact Assessment (DPIA), which would have formally identified and required mitigation of the very risks that led to the breach. This case illustrates that regulators will penalise both the technical failure and the procedural omission — organisations cannot separate security posture from GDPR accountability. A €200,000 fine serves as a stark reminder that insurance-sector entities handling large volumes of sensitive personal data face heightened scrutiny.","**Immediate actions:**\n- Conduct a DPIA for all high-risk processing activities involving large volumes of personal data, as required under GDPR Article 35.\n- Perform an emergency security audit of all IT systems exposed to external networks to identify and remediate known vulnerabilities.\n- Deploy ransomware-specific controls, including application whitelisting and disabling macros, on endpoints and servers handling personal data.\n\n**Long-term improvements:**\n- Establish a formal risk management programme that maps identified cyber threats to documented mitigation controls and reviews them at least annually.\n- Implement network segmentation to isolate systems containing personal data from general corporate infrastructure and internet-facing services.\n- Develop and regularly test an Incident Response Plan that includes ransomware-specific playbooks, notification timelines, and designated data protection roles.\n\n**Detection and compliance measures:**\n- Deploy centralised logging and SIEM tooling to detect anomalous access patterns and lateral movement indicative of ransomware precursor activity.\n- Maintain offsite and offline backups of personal data systems, tested regularly, to enable recovery without paying a ransom.\n- Schedule periodic third-party penetration tests and review DPIA outputs whenever there is a significant change to processing activities or the threat landscape.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"GDPR Article 5(1)(f) — Integrity and Confidentiality","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 32 — Security of Processing","GDPR Article 35 — Data Protection Impact Assessment","NIST CSF ID.RA-1 — Asset vulnerabilities are identified and documented","NIST CSF PR.IP-12 — A vulnerability management plan is developed and implemented","NIST SP 800-61 — Computer Security Incident Handling Guide","CIS Control 3 — Data Protection","CIS Control 11 — Data Recovery","CIS Control 12 — Network Infrastructure Management","CIS Control 17 — Incident Response Management","ISO\u002FIEC 27001:2022 Annex A 8.8 — Management of Technical Vulnerabilities","ISO\u002FIEC 27001:2022 Annex A 5.29 — Information Security During Disruption",{},"published","2026-07-16T10:20:22.786171+00:00","2026-07-16T10:20:22.513+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00020-2025&diff=52246&oldid=52111","aepd-spain-ps-00020-2025-0fb2d7","AEPD (Spain) - PS-00020-2025",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":41,"name":42,"slug":43,"description":44,"color":45},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":47,"name":48,"slug":49,"description":50,"color":51},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[54,58,62],{"slug":55,"name":56,"problem":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":59,"name":60,"problem":61},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":63,"name":64,"problem":65},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back."]