¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
THE COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMATION
LfDI Baden-Württemberg · P.O. Box 10 29 32 ·D-70025 Stuttgart
Notification of a personal data breach
Dear
Thank you very much for your notification of a personal data breach of February 15,
2019, in which you state the following:
On February 13, around 12.30pm, all employees of received an e-mail from the
account with a PDF attachment. This was reported to IT be-
cause the text in the e-mail was in English and this employee otherwise never com-
municates in English. There was a fake DocuSign link in the PDF with the aim of ac-
count phishing.
In the account of there was a rule activated in the inbox
which deletes all incoming e-mails immediately. Therefore it is to be assumed that
the account was compromised and that there is no mail spoofing.
The phishing e-mail sent also went to external e-mail addresses. In total (external
and internal) approximately 850 e-mail accounts.
As possible consequence you reported that identity theft may be possible if the recip-
ient has fallen for the phishing attachment.
Königstraße 10 a · D-70173 Stuttgart · Phone (+49) 711 615541-0 · Fax (+49) 711 615541-15 · [email protected] · [email protected]
www.baden-wuerttemberg.datenschutz.de · PGP Fingerprint: E4FA 428C B315 2248 83BB F6FB 0FC3 48A6 4A32 5962
For information on our privacy notice pursuant to Article 13 GDPR, please consult our webpage at the following address:
https://www.baden-wuerttemberg.datenschutz.de/datenschutz/
-2-
You explained that as corrective actions the password of the affected account was
changed immediately. All employees were informed and the danger of the e-mail was
pointed out. All recipients who were read out via the Microsoft log would be informed
on the day of the notification.
A support ticket was opened with Microsoft today to identify the attacker via IP.
You write that the personal data breach has been communicated to the data subjects
and that it was recommend to delete the e-mail and, in case that the attachment has
already been opened and the own account data have been entered there, to change
the account password.
The notification had been submitted within 72 hours after having become aware of it
and it describes the nature of the personal data breach as well as its likely conse-
quences and the measures taken to address the data breach as required in Article
33(1) and (3) GDPR. Also, the concerned data subjects have been informed as per
Article 34 GDPR.
From our point of view, the corrective measures taken by you are in order.
Unless new and relevant findings will occur in this matter, we hereby close the case.
Yours sincerely
on behalf