Numéro 16 | octobre 2026, semaine 5

ICO reprimands two organizations after a ransomware attack exposed children’s data

Compétence

Royaume-Uni

Nom légal du contrevenant

Ogi Networks Limited; Data Cymru

Domicile de l'infracteur

Royaume-Uni

Infraction présumée

A data breach

Action d'exécution

A reprimand

Statut de l'affaire

Une mesure administrative

The UK’s Information Commissioner’s Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru following a ransomware attack that exposed the personal information of 3,300 people, most of whom were children.

The attack took place on 1 November 2024 and encrypted 182.7GB of data, with 42GB stolen from Data Cymru’s systems. The information was linked to two projects supporting children and families.

The investigation found that the attackers exploited a test account called ‘Test2’, which had existed for more than 12 years. The account was protected by the password “Password1.”

The regulator found that ONL failed to maintain appropriate security measures and carry out regular checks of its systems. Data Cymru was also found to have failed to properly manage its relationship with ONL, review user accounts regularly and ensure the test account was removed or secured.

Both organizations have since taken steps to improve their security. ONL introduced regular account reviews and stronger access controls, including multi-factor authentication. The two organizations also signed a legally compliant data processing contract. Data Cymru introduced periodic account reviews and strengthened its access controls.

Frontier to pay $625,000 over a data breach impacting 59,000 Connecticut residents

Compétence

États-Unis

Nom légal du contrevenant

Frontier Communications

Domicile de l'infracteur

États-Unis

Infraction présumée

A data breach

Action d'exécution

A $625,000 fine

Statut de l'affaire

Une mesure administrative

Verizon-owned Frontier Communications has agreed to pay $625,000 to settle a data breach that exposed the personal information of 58,841 Connecticut residents in 2024.

The breach was discovered in April 2024, when hackers gained access to Frontier’s internal IT systems using stolen login details belonging to employees and vendors. An investigation found that the attackers had stolen unencrypted personal information, including Social Security numbers. The data was later offered for sale on the Dark Web.

An investigation also found weaknesses in Frontier’s security, including poor access controls, limited monitoring, and problems with encryption and employee training.

As part of the settlement with the Connecticut Attorney General’s Office, Frontier must pay the fine and improve its security measures, including stronger password rules, multi-factor authentication, employee training, and better systems to detect and prevent attacks.

Separately, Frontier agreed to a $5.64 million settlement in a related class-action lawsuit in Texas. The agreement covers around 750,000 people across the United States and includes two years of free credit monitoring.

23andMe successor settles with California for $6M

Compétence

États-Unis

Nom légal du contrevenant

Chrome Holding Co

Domicile de l'infracteur

États-Unis

Infraction présumée

A data breach

Action d'exécution

A $6 million settlement

Statut de l'affaire

Une mesure administrative

Chrome Holding Co, formerly known as 23andMe has agreed to pay the state of California $6 million over allegations of poor cybersecurity that contributed to a major data breach in 2023. The breach exposed sensitive personal and genetic information belonging to nearly 7 million people.

The settlement also ensures that affected customers can still request their data to be deleted and their genetic samples destroyed. The agreement is awaiting approval by a US bankruptcy court.

In March 2025, 23andMe filed for bankruptcy and sold customer genetic data and saliva samples to the nonprofit TTAM Research Institute, founded by a former CEO. California officials challenged the sale, arguing that customers should give explicit consent before their genetic information is transferred.

Meta ordered to pay $25 billion in a New Mexico privacy case

Compétence

États-Unis

Nom légal du contrevenant

Meta

Domicile de l'infracteur

États-Unis

Infraction présumée

Data privacy violation

Action d'exécution

A $25 billion fine

Statut de l'affaire

Une mesure administrative

Meta has been ordered to pay a $25 billion penalty in New Mexico following a data privacy case linked to the Cambridge Analytica scandal.

A jury in Santa Fe found the company liable in September 2026 for misleading New Mexico residents about how it collects and protects personal data and prevents harmful content from spreading on its platforms.

The jury identified more than 43 million violations of the state's unfair practices law. Each violation could carry a civil penalty of up to $5,000.

According to a court filing, the state was awarded $219.5 billion before the penalty was reduced to $25 billion.

South Africa fines two organizations for exposing personal info

Compétence

Afrique du Sud

Nom légal du contrevenant

Plusieurs entités

Domicile de l'infracteur

Afrique du Sud

Infraction présumée

Data breach

Action d'exécution

A fine of R1 million; a fine of R500,000, respectively

Statut de l'affaire

Une mesure administrative

The Information Regulator of South Africa has fined First National Bank (FNB) R1 million (€53,750) for failing to protect customers’ personal information.

The bank has 30 days to pay the fine after the regulator found that it had breached several provisions of the Protection of Personal Information Act (POPIA).

The investigation was launched following a security incident related to FNB’s digital home loan application platform that exposed customers’ personal information, including bank account numbers.

The regulator found weaknesses in the bank’s security systems and its handling of repeated security incidents, as well as protecting and storing customers’ information.

According to the regulator, FNB breached sections 5, 8, 12, 14, 15 and 19 of POPIA. The bank was also found to have committed an offense under section 105 for failing to implement measures to prevent illegal access to personal information.

In a separate case, the regulator fined Central Johannesburg TVET College R500,000 (€26,875) for sharing personal information with third parties without a lawful reason.