Export
HORA CREDIT IFN S.A
Hora Credit IFN S.A., a non-banking financial institution (the controller), suffered a cyberattack on its IT infrastructure.
StatusNot cited by any decision here yet
Holding
First, the DPA held that the controller violated Article 32 GDPR#1b]] and Article 32 GDPR#2]] by failing to implement adequate technical and organizational measures. The DPA found that the controller did not regularly test, assess, and evaluate the effectiveness of its security measures to ensure a level of security appropriate to the risk, including the ongoing confidentiality, integrity, availability, and resilience of its processing systems. Second, the DPA considered that these security failures facilitated a cyberattack on the controller's IT infrastructure. This incident resulted in unauthorized access to the personal data of a very large number of data subjects, including clients, employees, and collaborators, and compromised information stored in operational documents, electronic correspondence, and contractual files. Finally, based on the criteria for administrative fines set out in Article 83 GDPR#2]], the Romanian DPA decided to fine the controller €10,000 (RON 53,370) for the breach of Article 32 GDPR#1b]] and Article 32 GDPR#2]].
From GDPRhub’s case note — a summary of the decision, not its own words.Read it in the text ↓
Full text
Machine translation of the decision, via GDPRhub — not the official text.Read the original
November 11, 2026 Fine for Violating the GDPR In October 2026, the National Supervisory Authority for the Processing of Personal Data concluded an investigation into the data controller HORA CREDIT IFN S.A. and found a violation of Article 32, paragraph (1)(b) and paragraph (2) of Regulation (EU) 2016/679. As a result, the data controller was fined 53,370 lei, equivalent to 10,000 euros. The investigation was initiated following the submission by the data controller, HORA CREDIT IFN S.A., of a notification of a personal data breach, in accordance with the provisions of Article 33 of Regulation (EU) 2016/679. During the investigation, it was found that, following a cyberattack on the operator’s infrastructure, the confidentiality, integrity, and security of personal data were compromised. This situation led to unauthorized access to the personal data of a very large number of data subjects (customers and former customers, employees and former employees, and contractors) contained in the controller’s operational documents, electronic correspondence, and contractual documents. As such, it was found that the controller had not implemented adequate technical and organizational measures and had not conducted periodic testing, evaluation, and assessment of the effectiveness of the technical and organizational measures to ensure the security of the processing, with a view to ensuring a level of security appropriate to the risk posed by the processing, including the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services. Consequently, based on the criteria for determining the penalty set forth in Article 83(2) of Regulation (EU) 2016/679, the data controller Hora Credit IFN S.A. was fined for violating the provisions of Article 32(1)(b) and (2) of Regulation (EU) 2016/679. Legal and Communications Department A.N.S.P.D.C.P.