Knuddels GmbH & Co. KG – €20,000 Fine (Germany, 2018)

The company had contacted the LfDI on 8 September 2018 with a data breach report after it had discovered that personal data of approximately 330,000 users, including passwords and email addresses, had been stolen by a hacker attack in July 2018 and had been made public in early September 2018. The company informed its users immediately and comprehensively about the hacker attack in accordance with the GDPR. The company provided the LfDI with exemplary disclosure of data processing and corporate structures as well as its own failings. The LfDI thus became aware that the company had stored the passwords of its users in plain text, i.e. unencrypted and unaltered (unhashed). The company used these clear text passwords when using a so-called "password filter" to prevent the transmission of user passwords to unauthorised third parties with the aim of better protecting the users. By storing the passwords in plain text, the company knowingly violated its obligation to ensure data security when processing personal data in accordance with Art. 32(1)a GDPR.