Transavia Airlines C.V. – €400,000 Fine (Netherlands, 2021)

In Oktober 2019, a malicious third party gained unauthorized access to (personal data contained in) the systems of Transavia Airlines C.V., which led to a data breach. In order to limit the damage and to determine what happened, Transavia engaged an external service provider to conduct a root-cause-analysis. Circumstances of the breach: By using (i) an automated method in which frequently used passwords are tried in a short time (password spray) and (ii) known user data from previous third-party data breaches (credential stuffing), the attacker succeeded in infiltrating Transavia's systems. The generic user account that was used to gain unauthorized access had the highest privileges on certain domains of the system and was used as a link between Transavia's HR system and the Active Directory. This allowed the attacker to explore the systems and take a targeted approach by taking the following actions: * On certain systems, log files were deleted to remove traces; * Through a penetration test, the user was able to find vulnerabilities in the IT landscape of Transavia; * Copying network documentation, business and other miscellaneous documents and six mailboxes Impact of the breach: a) Impacted data subjects: the personal data that had been compromised belongs to passengers, employees, suppliers and job applicants. The forensic report of the external service provider showed that approx. 80,000 passengers, approx. 3,000 employees, 200 suppliers and 10 job applicants were impacted by the breach b) Sensitive data: In addition to contact details of data subjects, the attacker also had access to sensitive data of the passengers. By using SSR codes (Special Service Request), Transavia tries to adapt its services to the needs of the passenger. From these codes, sensitive personal data (health data) can be indirectly derived (i.e., wheelchair user, blindness, or deafness). The forensic report showed that the health data of 367 people was leaked. Notification to data subjects: Fulfilling its obligations laid down in Article 34 GDPR, Transavia identified and notified in total 81,000 data subjects, as there may have been a high risk to the rights and freedoms of these data subjects. As a result of the notification of the data breach, the DPA decided to investigate whether sufficient appropriate technical and organizational measures were in place at the time of the data breach. This investigation showed that Transavia did not respect Article 32(1) and Article 32(2) GDPR by not taking the appropriate technical and organizational measures. First, the DPA considered that the passwords used, were considered as 'weak'. The DPA was informed that there is a password policy in which the requirements are stated per user profile. However, the DPA determined that the passwords used by the (generic accounts) in the attack did not meet these prescribed requirements. The reason for this was an incorrect risk assessment by Transavia (Transavia expected that the chance of a successful password spray attack or credential stuffing attack was greater with user accounts than generic accounts). Second, there was no well-implemented multi-factor-authentication (MFA). It was possible to access the CITRIX environment without MFA. Based on the above-mentioned risk assessment, Transavia decided to go for a phased roll-out of the MFA implementation, since the company asserted that these accounts had the highest priority. This means that, at first, MFA was merely to be implemented at user accounts, and later at the generic accounts. As a result, the multi factor authentication was not yet implemented for generic accounts at the time the data breach occurred Third, the DPA considered the absence of network segmentation. This is the division of the network into functional segments. With network segmentation, only the systems that need to communicate with each other are placed together in separate segments, and users only get access to the segments they need. Taking this basic preventive measure lowers the chance of unauthorized access drastically. Fourth, the DPA considered the fact that certain log-files were removed, which made it considerably harder to have a complete image of the data breach, after it occurred. Although Transavia worked together with an external company, specialised in IT-security, which could track suspicious behaviour, inter alia, because activity was being logged, certain critical logging was not undertaken and it was also possible to remove certain log-files. Besides the fact that above-mentioned security measures were already the norm, the implementation costs were also not considered to be that high. Then, the DPA considered that, the more widely the data is processed and the more sensitive it is, the greater the demands placed on data security. Now, Transavia engages in large-scale processing: the attacker had access to systems containing data of approx. 25 million passengers. Moreover, a part of this is also sensitive, since it is health data. Lastly, the DPA considered the risk of varying likelihood and severity for the rights and freedoms of natural persons. It concluded that this risk is particularly high since the malicious use of the personal data could have led to material and immaterial damage of affected data subjects. In view of the lack of appropriate technical safeguards which were already the norm, the low implementation costs, the large-scale processing, and the fact that also sensitive data was exposed in the breach, the DPA imposed an administrative fine of €400,000 on Transavia Airlines for violation of Article 32(1) and Article 32(2) GDPR.