[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQMMcmgK31Wscum9EdlsbrDAmCb_0YXcEQ6PzS4xuhco":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"7cd83855-eba2-4645-bba2-1fb47b8588f1","orange-romania-fined-100k-after-app-misconfigurations-expose-customer-data","e4ac9003-15be-444d-9f4a-ebbf601951fe","Orange Romania Fined €100K After App Misconfigurations Expose Customer Data","Orange Romania was fined €100,000 by Romania's data protection authority after application misconfigurations allowed customers to view other customers' invoices and personal data, while a publicly accessible ticketing platform with no VPN, MFA, or IP restrictions was exploited to steal sensitive customer information including banking details and credentials. The root cause lies in inadequate technical and organizational security measures, violating GDPR Articles 25 (Data Protection by Design and by Default) and 32 (Security of Processing). This case illustrates that misconfigured applications and unprotected internal platforms are not just technical oversights — they are regulatory violations carrying significant financial and reputational consequences. Organizations handling personal data must treat access controls and secure configuration as baseline compliance requirements, not optional hardening steps.","**Immediate Actions:**\n- Audit all customer-facing applications for broken object-level authorization (BOLA\u002FIDOR) vulnerabilities that could allow cross-account data access.\n- Enforce MFA, VPN requirements, and IP allowlisting on all internal and administrative platforms immediately.\n- Conduct an emergency review of any publicly accessible internal tools (ticketing, CRM, support platforms) to verify they are not exposed without authentication controls.\n\n**Long-Term Improvements:**\n- Implement a secure-by-default configuration baseline for all application deployments, enforced through automated configuration management tools (e.g., Ansible, Chef, or cloud policy engines).\n- Embed Data Protection by Design (GDPR Art. 25) reviews into the SDLC so access control and data minimization are validated before any application goes live.\n- Establish a recurring access control review process to ensure internal platforms are periodically re-evaluated for unnecessary public exposure.\n\n**Detection & Monitoring Measures:**\n- Deploy anomaly detection on application APIs to alert on unusual cross-account data access patterns indicative of IDOR exploitation.\n- Enable centralized logging for all authentication events on internal platforms and set alerts for access from unexpected IP ranges or without MFA.\n- Schedule regular third-party penetration tests specifically targeting authorization logic and internal platform exposure.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 32 – Security of Processing","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 CM-6 – Configuration Settings","NIST SP 800-53 IA-2 – Identification and Authentication (MFA)","NIST SP 800-53 SC-7 – Boundary Protection","OWASP API Security Top 10 – API1:2023 Broken Object Level Authorization (BOLA)","ISO\u002FIEC 27001:2022 – A.8.3 Information Access Restriction","ISO\u002FIEC 27001:2022 – A.8.9 Configuration Management",{},"published","2026-07-28T14:21:44.227422+00:00","2026-07-28T14:21:44.114+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_Fine_against_Orange_Romania_SA_of_July_17,_2026&diff=52515&oldid=52446","anspdcp-romania-fine-against-orange-romania-sa-of-july-17-2026-5acd3e","ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":62,"name":63,"problem":64},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]