DPIA

The wait is over
Ailance™ DPIA is here!

Top 5 fines in June 2025: Two million fines for credential stuffing attacks

Two fines were imposed in June 2025 for credential stuffing attacks.
Categories:

The highest fine was imposed on Vodafone in Germany in June 2025. Two million-euro fines were imposed in Spain and the UK for data breaches in which the attackers gained unauthorized access to data via credential stuffing. And in Ireland, the Department of Social Services was punished with a comparatively high fine. In contrast to other countries, it is possible to impose fines on authorities in Ireland and these are not capped.

Vodafone: 45 million euros (Germany)

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) has imposed two fines totaling 45 million euros on Vodafone GmbH.

A fine of 15 million euros was imposed because the mobile phone provider Vodafone had not sufficiently checked and monitored its partner agencies that conclude contracts with customers on behalf of the company. This led to cases of fraud in which customers were harmed by fictitious contracts or contract amendments.

In addition, a fine of 30 million euros was imposed due to security flaws in the authentication process for the combined use of the "MeinVodafone" online portal and the Vodafone hotline. These flaws allowed unauthorized third parties to access customers' eSIM profiles.

Vodafone has responded to the allegations by improving its processes and systems and replacing some of them completely. The aim is to minimize risks in the future. In addition, the selection and review processes for partner agencies have been revised. Finally, partners who were found to have committed fraud were also separated. The BfDI plans to review the effectiveness of these measures in a follow-up audit.

Reading tip: BfDI imposes fines of 45 million euros on Vodafone

Source: Press release "BfDI imposes fines against Vodafone" from June 3, 2025

Carrefour: 3.2 million euros (Spain)

The Spanish data protection authority Agencia Española de Protección de Datos (AEPD) has fined the supermarket chain Carrefour Spain a total of 3.2 million euros imposed. The reasons for this are several data breaches in connection with five consecutive data breaches in the period from October 2022 to September 2023. The security incidents concerned A total of 118,895 customer accountswhere attackers use so-called Credential stuffing unauthorized access. Among other things, names, addresses, dates of birth, ID data and contact details were compromised.

The AEPD notes that Carrefour inadequate technical and organizational measures pursuant to Article 32 GDPR to prevent such attacks. In addition, the company has taken action against the Principle of integrity and confidentiality pursuant to Article 5(1)(f) GDPR violated; in parts also against the Obligation to notify data subjects in accordance with Article 34 GDPR.

Carrefour had reported all five incidents to the AEPD itself. However, the supervisory authority accuses the company, having reacted too late and incompletelyespecially when informing those affected about the first three security incidents.

The specific breakdown of the fine is as follows:

  • 2 million euros for breach of Article 5(1)(f) GDPR (integrity and confidentiality)
  • 1 million euros for breach of Article 32 GDPR (data security)
  • 200,000 euros for breach of Article 34 GDPR (notification of data subjects)

Carrefour had admitted partial responsibility for the inadequate notification, but denied the other allegations. However, the AEPD did not accept these objections and found that the safety measures implemented neither sufficient nor timely were.

Source: AEPD fines Carrefour

23andMe: 2.31 million pounds (Great Britain)

The British data protection authority ICO (Information Commissioner's Office) has fined the US genetic diagnostics company 23andMe 2.31 million pounds (around 2.7 million euros). The reason: sensitive data of 155,592 British users was compromised in a large-scale cyber attack in 2023. The attack exploited credential stuffing techniques, in which stolen credentials from previous, unrelated data leaks were used to gain unauthorized access to user accounts. Personal information such as names, years of birth, places of residence, profile pictures, ethnicity, family trees and health records were exposed.

The ICO found that 23andMe had not implemented adequate security measures to prevent such attacks. In particular, it lacked additional verification steps for accessing and downloading raw genetic information. In addition, the company was slow to respond to warning signs: although the attack began in April 2023, a full investigation was only launched in October 2023 after an employee discovered that stolen data was being offered for sale on Reddit.

The study was conducted jointly with the Canadian Data Protection Commissioner. It underlines the importance of international cooperation in data protection. The ICO emphasized that the protection of sensitive personal data, especially genetic information, must be a top priority and that companies are obliged to take appropriate security precautions to protect such data.

Source: Press release from the Information Commissioner's Office dated June 17, 2025

Yliopiston Apteekki: 1.1 million euros (Finland)

The Finnish data protection authority Tietosuojavaltuutetun toimisto has imposed a fine of 1.1 million euros on the pharmacy chain Yliopiston Apteekki. Between May 2018 and September 2022, the company used tracking technologies such as cookies and analysis tools in its online store, through which sensitive customer data was forwarded to third-party providers such as Google and Meta. This data included information about adding medicines to the shopping cart, clicking on the order button as well as IP addresses and other identifying characteristics. In particular, if customers were logged into their Google or Facebook accounts during their visit to the online store, these third-party providers were able to identify users directly.

The investigation was initiated after a doctoral student at the University of Turku pointed out data protection deficiencies in Finnish online pharmacies. Yliopiston Apteekki discontinued the use of Google and meta tracking technologies in September 2022, but intends to appeal the decision of the Data Protection Authority before the Administrative Court.

The data protection authority emphasized the particular sensitivity of health data and the need for appropriate protective measures to ensure customer confidence in online pharmacies.

Source: Press release by the Finnish Data Protection Authority Tietosuojavaltuutetun toimisto dated June 4, 2025

Department of Social Protection: 550,000 euros (Ireland)

The Irish Data Protection Commission (DPC) concluded its investigation into the use of facial recognition technology in the SAFE 2 registration process for the Public Services Card (PSC) by the Department of Social Protection (DSP) on June 12, 2025. The investigation, which began in July 2021, focused on the processing of biometric facial data and the use of corresponding technologies during the registration process.

The DPC found that the DSP had violated several provisions of the General Data Protection Regulation (GDPR):

  • Articles 5(1)(a), 6(1) and 9(1)The DSP was unable to provide evidence of a valid legal basis for the collection of biometric data in connection with SAFE 2 registration.he
  • Article 5(1)(e)Due to the lack of a legal basis, the storage of this data was also unlawful.
  • Article 13(1)(c) and 13(2)(a)The information obligations towards the data subjects were not sufficiently fulfilled.
  • Article 35(7)(b) and (c)The data protection impact assessment carried out was incomplete.

As a result, the DPC fined the DSP a total of 550,000 euros and ordered it to cease processing biometric data as part of the SAFE 2 enrollment within nine months unless a valid legal basis can be proven.

The DPC emphasized that its findings do not make any statement about the fundamental introduction of SAFE 2 registration, but relate exclusively to compliance with data protection requirements.

Source: DPC press release dated June 12, 2025

Tags:
Share this post :
en_USEnglish