Context
A reprimand has been issued to My Media World Ltd t/a Brand New Tube (BNT) in respect of Article 32 (1) and Article 32 (1) (d) of the GDPR. BNT failed to implement appropriate technical security and organisational measures to properly secure their systems, resulting in unauthorised access to their systems and the exfiltration of personal data relating to 345,000 UK Data Subjects.
Key points to note
- On or around 14 August 2022, an unauthorised third party gained access to BNT’s systems and exfiltrated the personal data of 345,000 UK Data Subjects, including the names, email addresses and passwords
- BNT have been unable to determine the specific cause of the incident advising on separate occasions that a server misconfiguration and a DDoS attack were responsible for the access to their systems.
- BNT were unable to provide evidence that they were conducting regular penetration testing or vulnerability scanning on their systems. They advised that a third party was responsible for providing this service, but could not confirm when scans were last performed, or what their methodology or use was.
- BNT did not have appropriate organisational measures in place to ensure the confidentiality and integrity of their systems.
- BNT have not provided any evidence to show the technical security measures in place at the time of the incident, or that they were even aware what these measures were, relying on the assurances of third-parties and employees without proof of any contracts or oversight.
Next actions
None – for information and awareness.