{"id":35330,"date":"2025-11-18T11:29:05","date_gmt":"2025-11-18T11:29:05","guid":{"rendered":"https:\/\/www.pkf-attest.es\/noticias\/ciberataque-sancion-datos-antiguos-2\/"},"modified":"2025-11-18T11:29:05","modified_gmt":"2025-11-18T11:29:05","slug":"ciberataque-sancion-datos-antiguos-2","status":"publish","type":"noticias","link":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/","title":{"rendered":"Cyberattacks and sanctions: the importance of protecting old data"},"content":{"rendered":"\n<p class=\"has-text-color has-link-color wp-elements-1 wp-block-paragraph\" style=\"color:#000000;font-size:20px\">Old data, deficient contracts and a 300,000 euro penalty<\/p>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-text-color has-link-color wp-elements-2\" id=\"h-brecha-de-seguridad-y-exposicion-de-datos-0\" style=\"color:#0f3780;font-size:24px\">Security breach and data exposure<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">In the summer of 2023, a technology company and service provider to an asset management company suffered a ransomware-type cyberattack. The <strong>breach <\/strong>not only compromised the security of its systems, but also took with it the asset management company&#8217;s information,<strong> including sensitive data of former employees who had left the company more than ten years ago. <\/strong>Names, IDs and other personal data were exposed in a vulnerable environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-text-color has-link-color wp-elements-3\" id=\"h-contratos-insuficientes-y-obligaciones-del-responsable\" style=\"color:#0f3780;font-size:24px\">Insufficient contracts and obligations of the responsible party<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">When the Spanish Data Protection Agency investigated the case, it discovered something even more worrying: not only had the <strong>confidentiality and availability<\/strong> of the data been put at risk, but also the <strong>contract <\/strong>between the agency and its data processor was <strong>insufficient<\/strong>, because it <strong>was limited to generic clauses <\/strong>that <strong>did not detail the security measures to be applied or the retention periods for the<\/strong> information <strong>.<\/strong> In other words, the agency had allowed old data to continue to exist unnecessarily in the hands of its supplier, becoming a <strong>weak point exploited by the attack.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">The AEPD was not convinced by the agency&#8217;s allegations: neither the reference to tax obligations nor the formal existence of a contract was sufficient to avoid liability. The authority was clear in recalling that <strong>it is not enough to reproduce standard formulas in a contract; it is essential to expressly define what measures are to be adopted, how they are to be applied and for how long the data will be kept.<\/strong> Otherwise, the controller is in breach of its obligation to actively supervise, instruct and control its data controllers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-text-color has-link-color wp-elements-4\" id=\"h-la-sancion-y-sus-consecuencias\" style=\"color:#0f3780;font-size:24px\">The sanction and its consequences<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">The result was a blunt one: <strong>a fine of 300,000 euros<\/strong> (250,000 euros for breach of the principle of integrity and confidentiality and 50,000 euros for deficiencies in the contract with the person in charge). With the reductions for voluntary payment and acknowledgement of liability, the figure could be reduced to \u20ac180,000, but <strong>the lesson was clear: data that is kept in excess and contracts that are empty of content not only increase the risk, but sooner or later end up being very expensive.<\/strong><\/p>\n","protected":false},"featured_media":19746,"template":"noticias-corporativa-single-post.php","categories":[],"tags":[214,212],"novedades_corporativa":[],"class_list":["post-35330","noticias","type-noticias","status-publish","has-post-thumbnail","tag-gdpr","tag-news","entry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.5 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Cyber-attack and 300,000 euro penalty for old data<\/title>\n<meta name=\"description\" content=\"300,000 fine after ransomware exposed old data and insufficient contracts.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyberattacks and sanctions: the importance of protecting old data\" \/>\n<meta property=\"og:description\" content=\"300,000 fine after ransomware exposed old data and insufficient contracts.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/\" \/>\n<meta property=\"og:site_name\" content=\"PKF Attest\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/11\/Banner_articulo_rgpd.png\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"180\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/\",\"name\":\"Cyber-attack and 300,000 euro penalty for old data\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Banner_articulo_rgpd.png\",\"datePublished\":\"2025-11-18T11:29:05+00:00\",\"description\":\"300,000 fine after ransomware exposed old data and insufficient contracts.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Banner_articulo_rgpd.png\",\"contentUrl\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Banner_articulo_rgpd.png\",\"width\":400,\"height\":180},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/ciberataque-sancion-datos-antiguos-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyberattacks and sanctions: the importance of protecting old data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/\",\"name\":\"PKF Attest\",\"description\":\"PKF Attest\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#organization\",\"name\":\"PKF-Attest\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/Logotipo_PKF-Attest-675x675-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/Logotipo_PKF-Attest-675x675-1.jpg\",\"width\":675,\"height\":675,\"caption\":\"PKF-Attest\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/1078028\\\/admin\\\/dashboard\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Cyber-attack and 300,000 euro penalty for old data","description":"300,000 fine after ransomware exposed old data and insufficient contracts.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/","og_locale":"en_US","og_type":"article","og_title":"Cyberattacks and sanctions: the importance of protecting old data","og_description":"300,000 fine after ransomware exposed old data and insufficient contracts.","og_url":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/","og_site_name":"PKF Attest","og_image":[{"width":400,"height":180,"url":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/11\/Banner_articulo_rgpd.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/","url":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/","name":"Cyber-attack and 300,000 euro penalty for old data","isPartOf":{"@id":"https:\/\/www.pkf-attest.es\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/#primaryimage"},"image":{"@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/11\/Banner_articulo_rgpd.png","datePublished":"2025-11-18T11:29:05+00:00","description":"300,000 fine after ransomware exposed old data and insufficient contracts.","breadcrumb":{"@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/#primaryimage","url":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/11\/Banner_articulo_rgpd.png","contentUrl":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/11\/Banner_articulo_rgpd.png","width":400,"height":180},{"@type":"BreadcrumbList","@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/ciberataque-sancion-datos-antiguos-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pkf-attest.es\/en\/"},{"@type":"ListItem","position":2,"name":"Cyberattacks and sanctions: the importance of protecting old data"}]},{"@type":"WebSite","@id":"https:\/\/www.pkf-attest.es\/en\/#website","url":"https:\/\/www.pkf-attest.es\/en\/","name":"PKF Attest","description":"PKF Attest","publisher":{"@id":"https:\/\/www.pkf-attest.es\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pkf-attest.es\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.pkf-attest.es\/en\/#organization","name":"PKF-Attest","url":"https:\/\/www.pkf-attest.es\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pkf-attest.es\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2023\/12\/Logotipo_PKF-Attest-675x675-1.jpg","contentUrl":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2023\/12\/Logotipo_PKF-Attest-675x675-1.jpg","width":675,"height":675,"caption":"PKF-Attest"},"image":{"@id":"https:\/\/www.pkf-attest.es\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/1078028\/admin\/dashboard\/"]}]}},"_links":{"self":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/noticias\/35330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/noticias"}],"about":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/types\/noticias"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/media\/19746"}],"wp:attachment":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/media?parent=35330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/categories?post=35330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/tags?post=35330"},{"taxonomy":"novedades_corporativa","embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/novedades_corporativa?post=35330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}