¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Berlin Commissioner for
Berlin, 10 June 2020 Data Protection and
Freedom of Information
535.696 Friedrichstr. 219
631.86 10969 Berlin
A56ID 74950 Visitors’ entrance:
DD 109067 Puttkamer Str. 16-18
FD 131464 The building is fully accessible to
disabled members of the public.
Final Decision
Contact us
Phone: +49 (0)30 13889-0
Fax: +49 (0)30 215 50 50
1. Facts concerning the data breach
Use our encrypted contact form
for registering data protection
- Controller: EyeEm Mobile GmbH (free online platform for shar- complaints:
www.datenschutz-berlin.de/be-
ing photos) schwerde.html
- Incident: Offering of personal data hacked at the controller in For all other enquiries, please
send an e-mail to:
the dark net (Dream Market) [email protected]
- Time and date of the incident: probably February 2018
Fingerprint of our
- Time and date of awareness of the incident: 12 Feb. 2019 PGP-Key:
- Concerned EU-/EEA-member states, each with the number D3C9 AEEA B403 7F96 7EF6
of the affected data subjects: C77F B607 1D0F B27C 29A7
o Germany: 54,440 Office hours
o Italy: 44,573
Daily from 10 am to 3 pm,
o Spain: 24,232 Thursdays from 10 am to 6 pm
o United Kingdom: 24,169 (or by appointment)
o France: 20,404
o Poland: 9,973 How to find us
o Netherlands: 8,290 The underground line U6 to
o Portugal: 7,098 Kochstraße / Bus number M29
and 248
o Austria: 6,327
o Hungary: 5,379
Visit our Website
o Romania: 5,017
o Sweden: 4,303 https://privacy.de
o Belgium: 4,299
o Czech Republic: 3,363
o Greece: 3,254
o Bulgaria: 2,496
o Norway: 2,476
o Lithuania: 2,459
o Denmark: 2,354
o Croatia: 1,888
o Slovakia: 1775
o Finland: 1,561
o Ireland: 1,342
o Slovenia: 1,274
o Latvia: 1,271
o Estonia: 856
-2-
o Cyprus: 649
o Luxembourg: 405
o Malta: 295
o Iceland: 180
o Liechtenstein: 39
- Category of data subjects: customers
- Category of the data types/data records concerned: names,
e-mail addresses, user account data, encrypted passwords
- Likely consequences of the violation of the protection of
personal data: Disclosure and misuse of the above personal
data
2. Description of the data breach from a technical-organizational
point of view
An external security auditor (Mauer IT Consulting) identified two
possible security vulnerabilities for the data breach: outdated Open-
VPN server version, open SSH ports.
3. Description and analysis of the effectiveness of the measures
taken to address the data breach or mitigate its adverse effects
(Art. 33 (3) (d) GDPR)
The passwords of affected users were blocked and access tokens
(access authorizations created for the respective applications of the
users) were deleted. The password hash procedure was changed to
Bcrypt. In addition, the security vulnerabilities described under 2.
were closed.
These measures will prevent the exploitation of the security gaps
found for the future. By resetting all access credentials, the attacker
is prevented from further access to accounts that have already been
taken over. The measures are considered to be sufficient.
4. Communication to the concerned data subjects or public com-
munication (Art. 34 (1) or Art. 34 (3) (c) GDPR)
The persons concerned were informed about the incident by the
controller in several stages, i.e. by two e-mails (in English). In addi-
tion, a data protection statement (German/English) was placed on
the website of the controller (following our recommendation at least
until the end of May 2019).
5. Technical and organisational measures that the controller had
already taken when the incident occurred, e.g. encryption (Arti-
cle 34 (3) (a) GDPR)
Even before the incident, a salted hash method was used, although
SHA1. A bulk decryption of the passwords is therefore more difficult.
-3-
6. Subsequent measures by which the controller has ensured that
a high risk to the concerned data subjects is no longer likely to
materialise (Art. 34 (3) (b) GDPR)
See 3.
7. Taken measures by the LSA Berlin DPA
Taking the specific circumstances of the facts determined into ac-
count, the Berlin DPA considers the case closed in regard to Art. 33
and Art. 34 GDPR.
Moreover, the Berlin DPA issues a reprimand to the controller with
regard to the underlying data protection violation (see attached let-
ter).