¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Berlin Commissioner for
Berlin, 13 July 2020 Data Protection and
Freedom of Information
631.87 Friedrichstr. 219
535.699 10969 Berlin
A56ID 74975 Visitors’ entrance:
CR 82038 Puttkamer Str. 16-18
RD 129527 The building is fully accessible to
FD 135778 disabled members of the public.
Contact us
Phone: +49 (0)30 13889-0
Fax: +49 (0)30 215 50 50
Final Decision Use our encrypted contact form
for registering data protection
complaints:
www.datenschutz-berlin.de/be-
schwerde.html
For all other enquiries, please
The Berlin DPA closes the case. send an e-mail to:
[email protected]
Fingerprint of our
PGP-Key:
1. Facts concerning the data breach
D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
- Controller: Dubsmash Inc. / Mobile Motion GmbH (Software) as
sole branch in EU/ EEA Office hours
- Incident: Offering of personal data hacked at Dubsmash in the Daily from 10 am to 3 pm,
Darknet (Dream Market) Thursdays from 10 am to 6 pm
(or by appointment)
- Time and date of the incident: unknown
- Time and date of awareness of the incident: 8. Feb. 2019 How to find us
- Concerned EU-/EEA-member states, each with the number
The underground line U6 to
of the affected data subjects: Kochstraße / Bus number M29
and 248
o United Kingdom: 2860348
o Germany: 2044890 Visit our Website
o Spain: 1624919
https://privacy.de
o Italy: 1558241
o Greece: 703880
o Czech Republic: 647773
o Romania: 592149
o Hungary: 508958
o Poland: 402999
o The Netherlands: 378192
o Belgium: 354687
o Sweden: 275121
o Austria: 229702
o Finland: 223663
o Portugal: 220004
o Slovakia: 203469
o Ireland: 179079
o Norway: 174624
-2-
o Denmark: 125390
o Croatia: 105163
o Bulgaria: 92405
o Slovenia: 54019
o Lithuania: 50308
o Cyprus: 40440
o Latvia: 36338
o Estonia: 12952
o Luxembourg: 11938
o Iceland: 10423
o Malta: 9954
o Gibraltar: 1369
o Liechtenstein: 596
o France: 1965728
o French Southern Territories: 6
o Vatican: 10
- Category of data subjects: Dubsmash users
- Category of the data types/data records concerned: User
names, passwords, date of birth, telephone number, e-mail ad-
dresses and country/language information, if provided by the
user
- Likely consequences of the violation of the protection of
personal data: Disclosure and misuse of the above data
2. Description of the data breach from a technical-organizational
point of view
The reason why the attackers were able to steal user data and pub-
lish it in the darknet could not be determined, partly because no ac-
cess logs were available at the service provider in the affected pe-
riod. The compromised database was stored with the Cloud-Hoster
Heroku. The access logs to backup data showed no abnormalities.
In addition, penetration tests were carried out.
3. Description and analysis of the effectiveness of the measures
taken to address the data breach or mitigate its adverse effects
(Art. 33 (3) (d) GDPR)
The company hired a forensics firm to identify network vulnerabili-
ties, but this was unsuccessful for the reasons mentioned above. In
addition, log-in credentials were changed and access controls were
reviewed.
4. Communication to the concerned data subjects or public com-
munication (Art. 34 (1) or Art. 34 (3) (c) GDPR)
The concerned data subjects were informed of the incident in writing
on 14 February 2019. In addition, press releases were published on
the same day (in several languages).
5. Technical and organisational measures that the controller had
already taken when the incident occurred, e.g. encryption (Arti-
cle 34 (3) (a) GDPR)
-3-
The stolen passwords were hashed with PBKDF2-SHA 256 using
salt values. A disclosure of the unencrypted passwords on a large
scale is therefore hardly possible even with knowledge of the data-
base.
6. Subsequent measures by which the controller has ensured that
a high risk to the concerned data subjects is no longer likely to
materialise (Art. 34 (3) (b) GDPR)
Among others, the controller:
carried out investigations on access control, examining user-
accounts and rights management. Access to the authorita-
tive postgres database via the cloud provider’s CU was lim-
ited to three Dubsmash employees, each of whom has their
own personalized accounts.
erformed forensic examinations of logs, including from Ama-
zon AWS, CloudTrail, Postgres SQL and GitHub, for hints on
a possible access to data and their transmission during the
period of the alleged data leaks.
o The Postgres SQL protocols were not available for
the November 2018 timespan;
o The CloudTrail protocols for potential access to the
S3-Bucket for the backup of the database showed no
accesses and no Data transmissions with regard to
the data stored there.
o The EC2B Backup log information showed for the pe-
riod of 6. January (only from this date protocols were
available) to February 9 (date of analysis) no unau-
thorised access; no protocol data for November 2018
were available anymore, because the data sets had
already been changed by the Linux operating sys-
tem.
o The GitHub log analysis showed that there were no
suspicious user activities that could lead to unauthor-
ized data transfer from the Postgres database.
Users were advised to change their passwords regularly and to
avoid the cross-platform use of passwords. The company has also
pointed out additional security measures to prevent the porting of
telephone numbers.
A 2-factor authentication was introduced for relevant services. In ad-
dition, it is now ensured that all internal communication channels
are also TLS encrypted. Also, organisational measures have been
taken to ensure that all software components are kept up-to-date on
a permanent basis.
7. Measures by the LSA Berlin DPA
Against the background of above considerations regarding Art. 33
and 34 GDPR the Berlin DPA closes this investigation.
-4-
Furthermore, the Berlin DPA has not identified any data protection
violations.