HAN University of Applied Sciences fined 175,000 euros for inadequate security

What it is about

In 2021 a hacker used SQL injection through a web form to reach a HAN web server and database server. The server held several hundred thousand records, including names with passwords, special category data, 407 citizen service numbers and 183 identity document numbers. The hacker demanded a ransom, which was not paid. The Dutch DPA found four shortcomings. Measures against SQL injection were insufficient and logging and monitoring were too limited. A database account had unrestricted rights across 282 databases. Data from retired applications was kept unnecessarily. Passwords were stored in plain text or hashed with MD5/SHA1. This breached Article 32 GDPR. The base fine of 310,000 euros was reduced to 175,000 euros because HAN actively limited the impact on data subjects, already had a security programme under way and shares lessons with other organisations. The DPA settled the case; HAN will not object.

What this means in practice

A data breach is not itself a violation, but missing risk assessment and inadequate measures are. A security policy on paper is not enough: least privilege and deletion policies must actually be implemented. Restrict account rights to what is needed, log and monitor database activity, purge data from retired applications and keep password hashing up to date. Actively limiting harm to data subjects, investing in security already under way and sharing lessons with others substantially reduces the fine.

The GDPR articles concerned

• Article 32: Security of processing