4Finance Spain Financial Services – €360,000 Fine (Spain, 2024)

On 10 August 2022, a data subject notified 4Finance Spain Financial Services, S.A.U. (the controller) that they had received an unsolicited loan to their bank account with the controller. By 1 September 2022, the controller had received 10 more complaints of a similar nature from clients. The controller assessed the risk levels and severity of these breaches in August, September and November of the same year using an internal method based on European Union Agency for Cybersecurity (ENISA) standards. Based on these assessments, the controller determined that it was not necessary to notify the violation to the AEPD or to affected parties. Between 3 and 23 February 2023, the AEPD received various complaints from data subjects, who were clients of the controller, alleging similar unsolicited loans to their accounts. On 14 February 2023, the controller claimed to become aware of a data breach affecting personal data of its clients and employees. The breach ultimately affected 9636 data subjects and included names, birth dates, national identification numbers, foreigner identity numbers, passport or identification document numbers, payment data (such as banks and cards) and contact information. The breach was a brute force attack that attempted different combinations of national identity numbers and emails with passwords. Once the attackers gained access to client accounts, they took out loans in the data subjects’ names, which the controller accepted and placed into client accounts. The hackers then contacted data subjects via WhatsApp, pretending to be the controller and requesting the refund of the amount to an account number controlled by the attackers. 139 of the affected data subjects were victims of this fraud. The controller notified the Spanish DPA (AEPD) of the data breach on 17 February 2023. It expressed that it did not consider the breach to pose a high risk to the rights and liberties of affected data subjects and that it thus would not communicate the breach to them directly. On 11 April 2023, the AEPD initiated an investigation against the controller and ordered the controller to communicate the breach to data subjects, which the controller did on the same day. In response to the breach, the controller registered the breach in the register of incidents, filed a police report, circulated a communication to clients noting that it did not communicate with clients via Whatsapp, reset certain user passwords and amended its password policy to require more complexity and implemented two-factor authentication. The AEPD found likely violations of Articles 5(1)(f) and 32 GDPR and recommended a €600,000 fine. The controller acknowledged its fault and paid a reduced fine of €340,000 in accordance with national law. In finding a likely violation of Article 5(1)(f) GDPR, the AEPD focused on the sensitive nature of the data, the method of attack and the number of affected data subjects. The types of personal data acquired in the breach, including data subjects’ contact information as well as their financial information and history, amplified the security risks. Such combinations of data, the AEPD noted, could be used to construct detailed financial profiles of data subjects that make them more vulnerable to identity theft, fraud and other cyberattacks – such as in this case, where attackers were able to contact data subjects after manipulating their finances. Due to the controller’s inadequate risk assessments and security measures, the AEPD also found a probable infraction of Article 32 GDPR. The AEPD noted that the controller’s handling of financial data and identification information is sensitive and thus obliges greater caution in implementing security measures. It thus considered the lack of a two-factor authentication prior to requesting a loan a serious oversight that facilitated the breach. Though it commended the controller’s adoption of mitigating measures including two-factor authentication after the breach, the AEPD found that these changes emphasised the shortcomings in its prior security system. Even after the controller was made aware of the risks by client complaints and internal risk assessments, it failed to adequately estimate the severity of the data breach. The inadequacy of the controller’s risk assessment was further demonstrated by its failure to communicate the incident to affected data subjects until ordered to do so by the AEPD. Given these likely violations, the AEPD resolved to initiate sanction proceedings against the controller and recommended a sanction of €600,000. Pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €360,000.