- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Knuddels GmbH & Co. KG – €20,000 Fine (Germany, 2018)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Knuddels GmbH & Co. KG was fined €20,000 for a data breach that exposed the personal information of about 330,000 users. The company stored user passwords in plain text, which is a serious security failure. This case highlights the importance of protecting user data to avoid costly penalties.
What happened
Knuddels reported a data breach where hackers stole personal data, including passwords and email addresses, of 330,000 users.
Who was affected
Approximately 330,000 users whose personal data was compromised in the breach.
What the authority found
The authority found that Knuddels violated GDPR by failing to secure user passwords properly.
Why this matters
This case serves as a warning to companies about the need for strong data security measures. Businesses must encrypt sensitive information to avoid fines and protect their users.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The company had contacted the LfDI on 8 September 2018 with a data breach report after it had discovered that personal data of approximately 330,000 users, including passwords and email addresses, had been stolen by a hacker attack in July 2018 and had been made public in early September 2018. The company informed its users immediately and comprehensively about the hacker attack in accordance with the GDPR. The company provided the LfDI with exemplary disclosure of data processing and corporate structures as well as its own failings. The LfDI thus became aware that the company had stored the passwords of its users in plain text, i.e. unencrypted and unaltered (unhashed). The company used these clear text passwords when using a so-called "password filter" to prevent the transmission of user passwords to unauthorised third parties with the aim of better protecting the users. By storing the passwords in plain text, the company knowingly violated its obligation to ensure data security when processing personal data in accordance with Art. 32(1)a GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for Knuddels GmbH & Co. KG in DE
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
21 November 2018
Authority
DPA LFDI
Fine Amount
€20,000
About this data
Cite as: Cookie Fines. Knuddels GmbH & Co. KG - Germany (2018). Retrieved from cookiefines.eu
Last updated: