- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
American Heart of Poland S.A. – €331,326 Fine (Poland, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
American Heart of Poland was fined after hackers accessed sensitive data due to poor security practices. The investigation revealed that the company failed to update its software and had weak passwords, leading to a significant data breach. This case highlights the critical importance of maintaining robust cybersecurity measures.
What happened
American Heart of Poland was fined for failing to secure personal data, resulting in a ransomware attack.
Who was affected
Approximately 21,000 employees and patients whose data was compromised were affected.
What the authority found
The Polish data protection authority found that the company violated GDPR by not implementing adequate security measures.
Why this matters
This case serves as a stark reminder for companies in all sectors about the necessity of strong cybersecurity practices. It shows that negligence in data protection can lead to severe financial penalties and harm to individuals.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 6 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A hackers group attacked one of Polish companies of medical sector - American Heart of Poland SA. The hackers got access to company’s network drives and installed a ransomware software. Following categories of personal data of approximately 21,000 company’s employees and patients was affected: * Name, surname, name of parents, date of birthday, e-mail address, phone number. * Address data. * PESEL number, ID number. * Bank account number, financial data. * Data concerning health. * Credentials of company’s user account. The hackers demanded ransom of USD 3,000,000. To make the company paid the ransom, the hackers shared a sample of obtained data on a Darknet website. Due to the lost of data availability and confidentiality of the data, the company acting as a data controller, notified the Polish DPA (UODO) about the breach, under Article 33 GDPR. In response, the DPA initiated the investigation. Initially, the controller didn’t find the source of data breach. However, after in-depth analysis of third-party specialist, it turned out that lack of company’s software update led to the breach – there was an exploit within the software, making it possible to gain exterbal control over one of the devices connected to the software. Company’s IT department, responsible for the update failed to do so. Also, the ISO audit of the controller didn't mention the exploit. Moreover, inadequate passwords quality and a phishing attack were indicated as a potential source of the breach. Additionally, during the investigation, the DPA found the controller stored the data affected by the breach contrary to their own policy – data relating to health had to be stored on a specific drives, not network ones. The data controller was actively involved in handling the data breach, inter alia by facilitating contact with data subjects (by a dedicated call centre). The outcome of investigation and identified shortcomings caused the DPA open an ex-officio proceedings against the controller. T
Related Enforcement Actions (0)
No other enforcement actions found for American Heart of Poland S.A. in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
20 May 2024
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€331,326
1,440,549 PLN
About this data
Cite as: Cookie Fines. American Heart of Poland S.A. - Poland (2024). Retrieved from cookiefines.eu
Last updated: