2024 American Heart of Poland — 21K, €330K GDPR fine
Data compromised
Health data, PESEL, bank accounts, passwords, IDs
Technical writeup
Hackers attacked IT infrastructure. Health records, PESEL, bank accounts, passwords exposed. UODO fined €330K for inadequate risk analysis, outdated servers (no support since 2020), poor phishing protection, COVID data on unsecured drives.
Root cause
Hacking; inadequate security controls