# ANSPDCP (Romania) - Auchan Romania S.A - Type: Enforcement - Source: ANSPDCP (Romania) - Date: 2026-11-03 - Original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Auchan_Romania_S.A - Canonical: https://overview.legal/posts/607518 - Topics: Data Breaches, Security, Notification Obligation, Controllers, Personal Data, Supervision, Access Controls, Supervisory Authorities, Right of Access, Integrity and Confidentiality Principle ## Summary Facts — Auchan Romania S.A. (controller), a retailer, gave unauthorised access of the personal data of a significant number of data subjects (internal users) to a third party following a cyberattack on an administrator account of one of the operator’s security systems. The personal data disclosed included the usernames, first names, last names, email addresses and passwords of the data subjects. The controller notified the DPA about the security breach and the DPA launched an investigation. During the investigation, the DPA found that at the time of the cyberattack, the controller had not implemented sufficient security measures concerning secure access to their network storage device. The implementation of sufficient measures would have mitigated the risk of the cyberattack. Holding — The DPA found that the controller has failed to implement adequate technical and organisational measures to ensure the confidentiality of their processing system and services. This failure led to the cyberattack. The DPA found a violation of Article 32(1)(b) GDPR and Article 32(2) GDPR. The DPA issued a fine of RON 41,908 (€8,000). Pursuant to Article 58(2)(d) GDPR, the DPA ordered the controller to carry out the technical and organizational implementation of access rules for all of the controller’s IT equipment exclusively from the company’s internal network. In cases where external access is deemed necessary, the DPA ordered the controller to access their system at least through the simultaneous use of a VPN and multi-factor authentication. ## Full text October 30, 2026 Penalty for GDPR Violation The National Supervisory Authority for Personal Data Processing has concluded an investigation into the data controller Auchan Romania S.A. and found a violation of the provisions of Article 32(1)(b) and (2) (2) of Regulation (EU) 2016/679. Accordingly, the data controller was fined 41,908 lei (equivalent to 8,000 euros). The investigation was initiated following the submission by the data controller, Auchan Romania S.A., of a notification regarding a personal data breach, in accordance with the provisions of Article 33 of Regulation (EU) 2016/679. The investigation found that the data security breach occurred as a result of a cyberattack on an administrator account of one of the operator’s security systems. This led to the unlawful access to and disclosure of the personal data of a significant number of data subjects (internal users), including: username, last name, first name, email address, and password. Furthermore, during the investigation, it was found that, at the time of the cyberattack, the operator had not implemented security measures with specific requirements regarding secure access to the network storage device that would mitigate the risk of unauthorized access to the aforementioned personal data. Consequently, it was found that Auchan Romania S.A. had not implemented adequate technical and organizational measures to ensure a level of security appropriate to the risk of processing, including the ability to ensure the confidentiality of processing systems and services. This situation led to the unauthorized disclosure of, or unauthorized access by a third party to, the personal data held by the controller, thereby violating the provisions of Article 32(1)(b) and (2) (2) of Regulation (EU) 2016/679. Pursuant to Article 58(2)(d) of Regulation (EU) 2016/679, a corrective measure was also ordered requiring the technical and organizational implementation of access rules so that access to all of the controller’s IT equipment is permitted exclusively from the company’s internal network, and in cases where external access is deemed necessary, it must be possible to access the system at least through the simultaneous use of a VPN and multi-factor authentication (MFA). Legal and Communications Department A.N.S.P.D.C.P ## Cited law provisions (6) ### GDPR — gdpr-art-32-par-1-pnt-b-en the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; ### GDPR — gdpr-art-32-par-2-en In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. ### GDPR — gdpr-art-58-par-2-pnt-d-en to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period; ### GDPR — gdpr-art-32-en Security of processing ### GDPR — gdpr-art-33-en Notification of a personal data breach to the supervisory authority ### GDPR — gdpr-art-58-en Powers --- Generated by overview.legal · https://overview.legal/posts/607518 · 2026-11-14