2020 — 33,000+ records
Data compromised
Addresses, emails, account numbers, taxpayer IDs, ID copies
Technical writeup
Oct 2020. Security vulnerabilities in login area and unrevoked credentials from former service provider allowed hackers to access customer data. Exposed: addresses, emails, account numbers, taxpayer IDs, identity document copies. Munich court ruled GDPR breach; ordered €2,500 compensation to victim. Additional lawsuits pending.
Root cause
Login vulnerabilities; unrevoked third-party credentials.