Case Study: Disabled antivirus and a 350,000 fine for GDPR violation

The disregard for antivirus software by a single employee highlighted critical IT infrastructure negligence across the entire company, contributing to a financial penalty of 350,000 PLN imposed on the enterprise.

Why did the President of the UODO punish the data controller?

At the end of last year, a company specializing in the sale of anti-burglary doors was fined over 350,000 PLN by the President of the Personal Data Protection Office (UODO).

The partner company also suffered damages, though significantly smaller, as the PUODO valued their offense at nearly 10,000 PLN.

Violated regulations – the grounds for the GDPR penalty:

• Art. 24(1), Art. 25(1), and Art. 32(1) and (2) of Regulation 2016/679

• Art. 5(1)(f) of Regulation 2016/679

• Art. 5(2) of Regulation 2016/679

• Art. 28(1) of Regulation 2016/679

• Art. 34(2) in conjunction with Art. 33(3)(c) and (d) of Regulation 2016/679

How did the data breach occur?

During the supervisory authority’s analysis of the case, it was revealed that the Controller committed numerous negligences related to updating implemented security measures, conducting risk analysis for its assets, controlling employee permissions to interfere with key safeguards, and most importantly, notifying the individuals affected by the data breach, as the potential consequences of the breach were downplayed.

One of the primary causes of the personal data breach was the disabling of the Controller’s licensed antivirus program by an employee. As a result of this incident – which should never have happened – processes initiating an encryption sequence were launched on the company server.

Cyber-negligence of the partner company 

This breach might have been avoided if the Controller had approached cybersecurity matters appropriately, ensured that operating systems were updated beforehand, and revoked user permissions that allowed interference with the system combining firewall and antivirus functions in a timely manner.

Today, antivirus software is an absolute foundation in building cybersecurity within organizations and one of the key elements for ensuring personal data protection.

Consequences of the ransomware attacks

As a result of the ransomware attack, the company briefly lost access to the data of its clients and employees, both current and historical.

Sensitive data, such as PESEL numbers, residential addresses, and bank account numbers, were compromised.

The company downplayed the matter, arguing that “unknown perpetrators” carried out the attack solely for blackmail purposes, not for data theft. However, this argument did not convince the UODO, given that the owners failed to provide evidence proving that the data had not been “stolen.”

Furthermore, the enterprise did not properly manage the flow of information with the data processor, who failed to report vulnerabilities in the server security and ignored software updates. This also influenced the final amount of the GDPR fine.

Recommendations

Regular risk analysis

Risk analysis is the “analytical” foundation of security. To ensure safety, every company should conduct a regular and reliable risk analysis. The risk analysis team should consist of specialists from specific areas. Based on such an analysis, security measures (technical, physical, and organizational) adequate to the threats can be implemented.

Restricting employee permissions

The ability of employees to interfere with security measures should be restricted according to their scope of duties. Even the best safeguards are useless if an unaware employee disables them.

Monitoring partner entities – the controller is responsible for security

If we outsource the management of a specific area to an external company, we must place great importance on verifying the level of security. We must monitor whether the partner fulfills their duties and takes care of updates and data protection. This is yet another ruling where, despite the noticeable fault of the processor, the controller is burdened with a significantly higher fine. You can read about another situation with a similar conclusion here:

Case study: How ignoring GDPR principles can cost millions – An analysis of errors by PANEK SA and ITCenter

In this case as well, the GDPR penalty was much more painful for the personal data controller.