- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Designbysi – Violation Found (Denmark, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Designbysi, a Danish fashion brand, faced scrutiny after hackers exploited a security flaw on its website. Customers were prompted to re-enter their payment information, which allowed hackers to collect sensitive data. This incident serves as a reminder for businesses to prioritize website security.
What happened
Hackers implemented a JavaScript code on Designbysi's website, leading to a data breach that exposed customers' payment card information.
Who was affected
Customers who attempted to purchase items on Designbysi's website during the breach period.
What the authority found
The authority found that Designbysi did not implement sufficient security measures to protect customer data, violating GDPR's security requirements.
Why this matters
This incident highlights the need for companies to adopt robust security practices, such as two-factor authentication, to safeguard customer information and avoid breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is Designbysi, a Danish fashion brand. Due to a security issue, hackers were able to implement a JavaScript code on Designbysi's website. Subsequently, customers saw an error message during their purchase with a request to re-enter their card information before purchasing an item. This enabled the hackers to collect the customers' payment card information. The hackers' attack could have potentially affected anyone purchasing items on the website between 26 April 2021 and 22 June 2021. It was not possible to identify exactly how many and which cards had been affected. As soon as Designbysi noticed the problem, the JavaScript code was removed and the personal data breach was reported to the DPA. Designbysi also sent a mail to all customers informing them about the breach and recommending them to contact their bank. Designbysi has also fixed the technical issue that made the attack possible. The Danish DPA issued a reprimand against Designbysi for violating Article 32(1) GDPR by not implementing sufficient technical and organisational measures to ensure an appropriate security level for the clients' accounts. In particular, Designbysi should have implemented two-factor authentication for persons who could change the website script.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Designbysi in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Designbysi - Denmark (2022). Retrieved from cookiefines.eu
Last updated: