Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Anonymised companies €173.9m 83 % · 16 cases
- The London Metal Exchange (LME) €11m 5 % · 1 case
- S-Pankki Oyj €7.67m 4 % · 1 case
- Government Employees Insurance Company (GEICO) €4.76m 2 % · 1 case
- Farmers Insurance Exchange €2.4m 1 % · 1 case
- Infinity Insurance Company €1.95m 1 % · 1 case
- PayPal, Inc. €1.92m 1 % · 1 case
- Delta Dental Insurance Company und Delta Dental of New York, Inc. €1.92m 1 % · 1 case
- Healthplex, Inc. €1.71m 1 % · 1 case
- FIIG Securities Limited €1.48m 1 % · 1 case
- 5 more€1.03m
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 4 | €70m |
| 2023 | 7 | €93.5m |
| 2024 | 6 | €15.2m |
| 2025 | 8 | €26.7m |
| 2026 | 5 | €4.36m |
30 cases
22 Sep 2026 OTC Link LLCOTC Link: 575,000 USD – security policies never completed despite examination findings €501,614
From 2016 to 2025, the operator of the OTC Link ATS trading system lacked complete policies on systems security, access control and vulnerability management as required under Regulation SCI. Although the examiners of the U.S. Securities and Exchange Commission (SEC) had criticised the gaps in several examinations, drafts remained unfinished; the SEC issued a censure and imposed 575,000 USD.
Track supervisory examination findings with a deadline and a responsible person – points that remain open repeatedly become expensive.
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Regulation SCI, Rule 1001(a)(1)–(3)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Repeat case
- yes
Original amount 575,000 USD, converted at the ECB reference rate of 22 Sep 2026.
- SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI (22.09.2026) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
5 Aug 2026 Order Express, Inc.NYDFS: $250,000 against money transmitter Order Express over cyber deficiencies €216,375
The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.
Even small financial service providers must keep documented patch policies and regular risk assessments.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.
- Published
- 5 Aug 2026
Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.
- New York State Department of Financial Services Secures Cybersecurity Settlement with Order Express, Inc. Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
28 Jul 2026 Luk Fook Securities (HK) LimitedLuk Fook Securities: HKD 2.1m fine for weak cybersecurity ahead of ransomware attack €235,595
Luk Fook Securities (HK) was publicly reprimanded and fined 2,100,000 HKD because inadequate cybersecurity controls might have contributed to a ransomware attack on 19 September 2022 hitting numerous core servers and to full recovery taking until 7 October 2022; during that time clients could not trade via the app or internet platform. Findings included missing firewall protection, outdated operating systems and antivirus software, weak access and password controls with credentials stored unencrypted, insufficient controls over remote access and external devices, inadequate data backup and a last security training session in 2018.
Basic cyber hygiene – patching, access and password controls, backups and regular staff training – is a regulatory obligation for financial firms.
Ransomware defence, password security and security awareness training
Missing or inadequate training played a role in the decision.
- Authority / court
- Securities and Futures Commission (SFC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- s. 194 SFO (Cap. 571); Code of Conduct GP 2, GP 3, GP 7, paras. 12.1, 18.5 und Schedule 7; Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Repeat case
- no
- Mitigating circumstances
- Root-cause review with an independent reviewer, strengthened controls, no evidence of client loss, cooperation, clean disciplinary record.
- Published
- 28 Jul 2026
Original amount 2,100,000 HKD, converted at the ECB reference rate of 28 Jul 2026.
- SFC press release 26PR118: SFC reprimands and fines Luk Fook Securities (HK) Limited $2.1 million for inadequate cybersecurity control (28.07.2026) Press release of an authority
- SFC Statement of Disciplinary Action zu 26PR118 Decision of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
29 Apr 2026 Delta Dental Insurance Company und Delta Dental of New York, Inc.NYDFS: $2.25 million against Delta Dental after MOVEit attack and late notification €1.92m
In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.
Keep data in transfer tools only for as long as necessary – and report security incidents to the supervisory authority on time.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 30 Apr 2026
Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.
- DFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental Press release of an authority
- Consent Order to Delta Dental 2026 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
9 Feb 2026 FIIG Securities LimitedFIIG Securities: 2.5 million AUD for inadequate cyber security ahead of data theft €1.48m
The Federal Court of Australia, on application by the Australian Securities and Investments Commission (ASIC, Australia's corporate, markets and financial services regulator), imposed a penalty of 2.5 million AUD on the fixed-income specialist because between March 2019 and June 2023 it lacked adequate cyber security measures, resources and risk management systems – among other things, there was no multi-factor authentication for remote access, no regular penetration testing and no mandatory security awareness training. In a 2023 attack around 385 GB of confidential data were stolen and some 18,000 clients were notified; the court also ordered a compliance programme with an independent expert.
For licensed financial services firms, cyber security is part of their licence obligations: basic measures such as MFA, patching, monitoring, training and a tested incident response plan must be funded and actually implemented.
Cyber security basics: multi-factor authentication, patch management, security awareness training, tested incident response plan
Missing or inadequate training played a role in the decision.
- Authority / court
- Federal Court of Australia (auf Antrag der Australian Securities and Investments Commission, ASIC)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Corporations Act 2001 (Cth) s 912A(1)(a), (d) und (h) i. V. m. s 912A(5A)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Repeat case
- no
- Mitigating circumstances
- Full cooperation, admissions and an agreed statement of facts; no previous contraventions; the known financial losses (remediation costs of around 1.5 million AUD) were largely borne by the company itself.
- Published
- 9 Feb 2026
Original amount 2,500,000 AUD, converted at the ECB reference rate of 9 Feb 2026.
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
14 Oct 2025 Farmers Insurance ExchangeNYDFS: $2.775 million against Farmers over unprotected online quoting tools €2.4m
Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.
Automatically pre-filled forms containing customer data are a point of entry – scrutinise public-facing applications for the data they disclose.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
- Published
- 14 Oct 2025
Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.
- DFS Secures More than $19 Million from Auto Insurance Companies over Data Breaches Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
14 Oct 2025 Infinity Insurance CompanyInfinity Insurance: 2.25 million USD – data leak via quoting tool reported too late €1.95m
Attackers extracted driver’s licence numbers in plain text via the motor insurer’s instant quote applications. Infinity discovered the anomalies on 9 February 2021 but only reported the cybersecurity event to the New York State Department of Financial Services (NYDFS) on 14 April 2021; the supervisor also criticised the lack of MFA and insecure development practices.
Misuse of publicly accessible customer applications is also a reportable incident – warnings from the supervisor should trigger an immediate reporting assessment.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- 23 NYCRR § 500.17(a), § 500.12(a) u. a.
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 2,250,000 USD, converted at the ECB reference rate of 14 Oct 2025.
- NYDFS Consent Order to Infinity Insurance Company (14.10.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
22 Sep 2025 Nova Ljubljanska banka d. d.NLB: reprimand because PSD2 interface exposed 57 account numbers Reprimand or warning
After an update of the PSD2 interface for third-party providers in July 2023, the confidentiality of 57 IBAN accounts of bank customers was not ensured. The banking supervisor, Banka Slovenije (Bank of Slovenia), issued a reprimand to the bank for breaching the obligation to protect confidential data (final).
Every change to customer interfaces requires testing for data leakage before go-live.
Security testing for software releases of interfaces
- Authority / court
- Banka Slovenije
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 146, Art. 396 Abs. 1 Nr. 18 ZBan-3 (slowenisches Bankengesetz)
- Action
- Reprimand or warning
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Liability of senior managers
- Measures against individuals are not reported here.
- Banka Slovenije, Veröffentlichung der Sanktion gegen Nova Ljubljanska banka d. d. (Entscheidung 2025) Decision of an authority
- Banka Slovenije – Informacije o izrečenih ukrepih Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Direct link
Report an error
14 Aug 2025 Healthplex, Inc.Healthplex: 2 million USD – phishing incident not reported to supervisor for months €1.71m
An employee of the dental insurance service provider disclosed his login credentials via a phishing e-mail; the mailbox containing over 100,000 e-mails with health and social security data was accessible. Healthplex had known about the incident since November 2021 but only reported it to the New York State Department of Financial Services (NYDFS) in April 2022 instead of within 72 hours; in addition, there was no MFA for web access and no data retention and deletion policy.
Security incidents require a fixed reporting process with deadline control – the 72-hour clock starts when the incident is identified, not when forensics is completed.
Recognising phishing; reporting channels for security incidents
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- 23 NYCRR § 500.17(a), § 500.12(b), § 500.13, § 500.17(b)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 2,000,000 USD, converted at the ECB reference rate of 14 Aug 2025.
- NYDFS Consent Order to Healthplex, Inc. (14.08.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
10 Jul 2025 Poste Vita S.p.A.Poste Vita: 80,000 EUR – data breach notified only four months after customer’s alert €80,000
A fraudster impersonated a customer by e-mail and, between 2021 and 2023, obtained information and documents on three policies from the life insurer’s case handlers without his identity being verified. Although the customer alerted the company to the false e-mail address in September 2024, Poste Vita only notified the breach to the supervisory authority in January 2025.
Customer alerts about possible data leaks must go into the incident assessment immediately – not only after internal checks are completed.
Identity verification for customer requests by e-mail (social engineering)
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 5 Abs. 1 lit. a und f, Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Culpability
- negligent
- Mitigating circumstances
- Immediate blocking of further communication, internal investigation, criminal complaint and stricter identity verification.
- Garante privacy, Provvedimento del 10 luglio 2025 [10154110] Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 May 2025 S-Pankki OyjS-Pankki: EUR 7.67m and public warning over faulty banking software €7.67m
The Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority) imposed a joint penalty payment of 7,670,000 EUR on S-Pankki Oyj for failings in operational risk management and additionally issued a public warning. A programming error that was live in a bank system from 20 April to 5 August 2022 had not been adequately tested beforehand; the bank lacked a sufficiently secure system and effective incident management and was insufficiently prepared for outsourcing risks. The warning concerns the failure to apply the required strong customer authentication and payments executed without the payers' consent from 6 May to 5 August 2022; earlier penalty payments imposed on the bank by the supervisor (2019 and 2021) increased the amount. The decision is not final.
Changes to authentication and payment processing need documented testing before going live – even when a service provider develops the software.
Testing and change management for security-critical banking software
- Authority / court
- Finanssivalvonta (FIN-FSA)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Luottolaitostoiminnasta annettu laki 9 luku 16 § (1, 2 und 4 mom.) mit MOK 8/2014; FivaL 40 §, 41 §, 41 b §; öffentliche Verwarnung nach FivaL 39 § wegen Maksupalvelulaki 85 c § 1 mom. und 38 § 1 mom.
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Financial services and insurance
- Repeat case
- yes
- Mitigating circumstances
- Measures to prevent recurrence and cooperation with the supervisor in the investigation reduced the amount.
- Published
- 23 May 2025
- Finanssivalvonta: S-Pankki Oyj:lle 7 670 000 euron yhteinen seuraamusmaksu ja julkinen varoitus (23./26.05.2025) Press release of an authority
- Finanssivalvonta: Toimituskirja johtokunnan päätöksestä 23.5.2025, FIVA/2024/1181 Decision of an authority
- Finanssivalvonta: Finanssivalvonnan päätökset (Lainvoimaisuus: S-Pankki hat beim Verwaltungsgericht Helsinki Beschwerde eingelegt) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
20 Mar 2025 The London Metal Exchange (LME)London Metal Exchange: 9.2 million GBP – controls and escalation failed in nickel turmoil €11m
When the nickel price rose to over 100,000 USD within just over an hour on 8 March 2022, only junior staff were on duty during Asian trading hours, and they had not been trained to recognise a disorderly market; they did not escalate and even switched off price bands. The Financial Conduct Authority (FCA) imposed a fine on the recognised investment exchange for the first time: 9.2 million GBP after a 30% discount.
Critical infrastructure needs trained staff around the clock and clear escalation paths – including at night and at off-peak times.
Escalation of unusual market conditions; training of shift staff
Missing or inadequate training played a role in the decision.
- Authority / court
- Financial Conduct Authority (FCA)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- FCA REC 2.5.1 (Recognition Requirements); Art. 18 RTS 7 (MiFID II)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Early settlement (30% discount); improvements since March 2022.
Original amount 9,200,000 GBP, converted at the ECB reference rate of 20 Mar 2025.
- FCA: First FCA enforcement action and fine against Recognised Investment Exchange (20.03.2025) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Jan 2025 PayPal, Inc.NYDFS: $2 million against PayPal over untrained teams and missing MFA €1.92m
When changing data flows for 1099-K tax forms, insufficiently trained teams bypassed security processes; criminals with compromised credentials were able to retrieve forms containing social security numbers. According to the New York State Department of Financial Services (NYDFS), qualified personnel, training, access policies as well as MFA, CAPTCHA and rate limiting were lacking.
Anyone changing data flows must know the security processes – training development teams is part of cyber defence.
Secure software development and change processes
Missing or inadequate training played a role in the decision.
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR Part 500 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Culpability
- negligent
- Mitigating circumstances
- PayPal has since remedied the deficiencies.
- Published
- 23 Jan 2025
Original amount 2,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.
- DFS-Pressemitteilung vom 23.01.2025: Cybersecurity-Vergleich mit PayPal, Inc. (2 Mio. $) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
25 Nov 2024 Government Employees Insurance Company (GEICO)GEICO: 5 million USD from NYDFS over cyberattacks on quoting and claims portals €4.76m
From late 2020 onwards, attackers obtained non-public data of New Yorkers, above all driver's licence numbers, in several incidents through publicly accessible web applications of the car insurer GEICO – including the quoting portal, the claims website and an interface. The New York State Department of Financial Services (NYDFS) found breaches of the cybersecurity regulation 23 NYCRR Part 500, including inadequate risk assessments, missing monitoring of user activity and incorrect compliance certifications for 2017 to 2021, and imposed a penalty of 5,000,000 USD. In parallel, GEICO pays a further 4,750,000 USD in a separate settlement with the New York Attorney General. The authority allegedly made the findings set out here; this account is not based on a final judgment.
After an incident it is not enough to close the one gap – all publicly accessible applications need to be reassessed, especially once the industry has been warned.
Security of publicly accessible web applications; responding to industry alerts
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR §§ 500.2(b), 500.3(i) und (k), 500.5, 500.8(a), 500.9(a), 500.14(a), 500.17(b); Strafe nach New York Financial Services Law § 408
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- The NYDFS acknowledged the company's cooperation during the investigation and its substantial investment in remediating the shortcomings.
- Published
- 25 Nov 2024
Original amount 5,000,000 USD, converted at the ECB reference rate of 25 Nov 2024.
- NYDFS, In the Matter of Government Employees Insurance Company, Consent Order (so ordered 25.11.2024) Decision of an authority
- NYDFS-Pressemitteilung: Attorney General James and DFS Superintendent Harris Secure $11.3 Million from Auto Insurance Companies over Data Breaches (25.11.2024) Press release of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
1 Oct 2024 a US swap trading platformSwap trading platform: 875,000 USD because emergency and security tests were not brought before the board €789,284
A US swap trading platform did not fully inform its board of the results of emergency, technology risk and penetration tests, did not regularly test its business continuity and disaster recovery capabilities and had no adequate risk management. It also failed to produce documents requested during an examination on time despite extensions of deadlines; the Commodity Futures Trading Commission (CFTC) imposed 875,000 USD.
Contingency plans only count if they are tested regularly and the results are noted by the entire governing body.
- Authority / court
- Commodity Futures Trading Commission (CFTC)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Swap Execution Facilities
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
Original amount 875,000 USD, converted at the ECB reference rate of 1 Oct 2024.
- CFTC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 1 Oct 2026 · Direct link
Report an error
22 May 2024 a US exchange group and nine of its subsidiariesUS exchange group: 10 million USD – cyber attack not reported to the SEC €9.23m
In April 2021, a third party alerted the group to a vulnerability in its VPN; the group found malicious code that had been inserted but did not inform the legal and compliance officers of its exchange and clearing subsidiaries for days. As a result, the subsidiaries, including a stock exchange, did not immediately report the incident to the U.S. Securities and Exchange Commission (SEC) as required under Regulation SCI; the group paid 10 million USD.
Operators of critical market infrastructure need internal reporting channels that pass cyber incidents on to all entities subject to reporting obligations within hours.
Internal escalation of cyber incidents to compliance
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Regulation Systems Compliance and Integrity (Regulation SCI), Meldepflichten
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Repeat case
- yes
Original amount 10,000,000 USD, converted at the ECB reference rate of 22 May 2024.
- SEC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 May 2026 · Direct link
Report an error
12 Mar 2024 a Polish major bankPolish major bank: 1.44 million PLN – stolen customer documents not reported €336,066
A courier consignment containing bank documents (including PESEL numbers, account numbers, login credentials) was stolen and discarded on a housing estate; the supervisory authority learned of it from the media. The bank had informed neither the authority nor the data subjects because it rated the risk as low – it had already been sanctioned in 2022 for failing to notify data subjects.
Assess the risk of a data breach from the data subjects’ perspective – failing to notify the loss of sensitive documents risks a higher penalty than the breach itself.
Risk assessment and notification of data breaches
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1, Art. 34 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Repeat case
- yes
- Published
- 2 Apr 2024
Original amount 1,440,549 PLN, converted at the ECB reference rate of 12 Mar 2024.
- UODO, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
- UODO, Entscheidungsdatenbank (Suche) (Entscheidung 2024) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link
Report an error
12 Mar 2024 a Polish bank belonging to a car manufacturerPolish bank: 78,575 PLN – misdirected mailing reported only after 1.5 years €18,331
The bank sent a customer’s contract data to the wrong recipient and only reported the breach one and a half years later, when the supervisory authority made enquiries following a complaint. Given the risk of identity theft, the authority considered that there had been an obligation to notify within 72 hours.
Even a single misdirected mailing containing identity data is notifiable – misdirected mail cases need a documented risk assessment.
Recognising misdirected mail and reporting it internally
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 2 Apr 2024
Original amount 78,575.4 PLN, converted at the ECB reference rate of 12 Mar 2024.
- UODO, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
- UODO, Entscheidungsdatenbank (Suche) (Entscheidung 2024) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link
Report an error
8 Feb 2024 a German major bankBaFin fines a major bank €50,000 for flawed reporting of an IT security incident €50,000
BaFin (German Federal Financial Supervisory Authority) imposed a fine of 50,000 EUR on a German major bank because the bank had given it incorrect information about a major customer-relevant IT security incident affecting its payment services in 2023 and had informed it considerably late. The decision of 8 February 2024 is final.
IT incident reports must be fast and accurate; incorrect information given to the supervisor is sanctioned in its own right.
Reporting major IT security incidents correctly and on time
- Authority / court
- Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- § 64 Abs. 3 Nr. 15 ZAG
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Published
- 18 Mar 2024
- BaFin, Maßnahmen und Sanktionen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 2 Oct 2026 · Company name anonymised since 8 Feb 2026 · Direct link
Report an error
27 Nov 2023 a US title insurerNYDFS: $1 million against US title insurer over open document links €913,159
An application of the insurer generated links to transaction documents without login and without an expiry date; according to a journalist, by changing the sequential document number, 885 million documents containing, among other things, social security and bank data could be retrieved. Users were told not to send sensitive data, but there were no technical barriers. The penalty was imposed by the New York State Department of Financial Services (NYDFS).
Instructions to users do not replace technical controls – sharing links need authentication and an expiry date.
Classification and sending of sensitive documents
- Authority / court
- New York State Department of Financial Services (NYDFS)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- 23 NYCRR §§ 500.3, 500.7 (Cybersecurity Regulation)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- negligent
Original amount 1,000,000 USD, converted at the ECB reference rate of 27 Nov 2023.
- NYDFS, Newsroom (Übersicht) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 Nov 2025 · Direct link