¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Barichgasse 40-42
A-1030 Vienna
Tel.:+ 43-1-52152 302579
E-mail:[email protected]
GZ:D155.022
2021-0.540.987 SachbearbeiterinMag.
Notification of personal data breaches to the supervisory authority
(Art. 33 GDPR, “Data-Breach-Procedure”)
(IMI Nr.: A56ID 123192)
Draft Decision
By notification of 18 March 2020 as well as the follow-up reports of 26 March 2020 and 23 April 2020,
(controller) informed the Austrian Data Protection Authority on a breach of the
protection of personal data.
In summary, on March 16, 2020, the controller noted a cyber attack as there was an increased activity
(number) of user access requests that caused user authentication errors. The attackers had obviously
obtained the names and passwords of the concerned accounts before the authentication attempt and
were able to access 624 user accounts, 97 of which were from the European Union.
The concerned individuals are residing in the following EU countries: Croatia, Germany, Austria,
Belgium, Denmark, Italy, Sweden, Romania, Poland, Hungary, Spain, France, the Netherlands and
Portugal.
A total of 624 Users, 97 of them based in the E.U., were affected by the incident.
The data of the categories
Usernames (email address) and passwords (known to the attacker before the attack)
User device type (Android device, iOS device)
Application program (iTranslate iOS, iTranslate android)
User_ID
Newsletter subscribed (Yes, No)
Installation_ID
have been affected.
The person responsible has taken the following measures to remedy the injury or mitigate possible
adverse effects:
—2—
After discovering the unusual activities, access has been blocked and passwords have been
reset.
An e-mail has been send to the affected customers to inform them about the incident and the
measures taken. It was recommended to them to change their passwords.
The responsible parties have taken the following measures to prevent such incidents in the future:
A new patch has been installed to block suspicious IP addresses after a failed authentication
attempt.
The controller has taken appropriate steps to minimise the risk and to eliminate, as far as possible, the
adverse consequences of the security breach. Further measures of the data protection authority
according to Art. 58 para. 2 lit. e GDPR or § 22 para. 4 DSG are not required.
The procedure will therefore be closed and the controller will be notified thereof.
4. August 2021
Für die Leiterin der Datenschutzbehörde: