Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
55 articles found · #rgpd · Veille Luxgap
PNLD: 135,000 police and partner contacts published on the dark web
The UK’s Police National Legal Database (PNLD) confirmed 1.9 GB of data was posted online: 114,000 PNLD subscribers and 21,000 “Ask the Police” users. The attack, claimed by ExfilSquad, was detected on July 26, 2026.
Liechtenstein: UBO register hacked (31,000 individuals affected)
Liechtenstein confirms data exfiltration from its UBO register (VwbP), affecting around 31,000 individuals. A stark reminder: these registers hold highly sensitive data that must be protected as critical assets.
Coca‑Cola/Fairlife: ransomware, production halt and data theft
Coca‑Cola confirms data theft following a ransomware attack against Fairlife. U.S. production was suspended mid‑July; the Anubis group claims up to 1 TB of data.
Garante vs Lusha: €2M fine for data brokering without legal basis
Italy’s Garante fined Lusha €2,000,000 for collecting/selling professional contacts without a legal basis and adequate information. A strong signal for the use of data enrichment tools in the EU.
CNIL: New Guidelines on Tracking Pixels in Emails
The CNIL releases guidelines and FAQs to regulate tracking pixels in emails, affecting companies using tracking tools. A key priority for DPOs and CISOs across Europe.
Wind Tre: €1.715M for unprotected APIs and poor key management
Italy’s DPA fined Wind Tre €1,715,600 for security gaps: weak certificate/key management and APIs lacking basic controls, leading to data exfiltration affecting 365,048 customers (41,359 with payment data).
Secureholiday (Ctoutvert): 41,577 Dutch campers affected
Ctoutvert (Secureholiday) confirms a breach affecting 41,577 Dutch campers. No IBANs or cards leaked, but emails, phone numbers and stay dates exposed and used for targeted fraud.
Six weeks of downtime: German SME goes insolvent after cyberattack
On 14 July 2026, ZEGO (Aschaffenburg, DE) filed for insolvency after a March 29 cyberattack halted production for nearly six weeks—an explicit illustration of the operational cost of incidents for manufacturers.
Cookies: EDPB orders Belgian DPA to decide the merits in the VRT case
On 14 July 2026, the EDPB ordered the Belgian DPA to rule on the merits of NOYB’s complaint against VRT’s cookie banner, rejecting the abuse-of-rights argument. A signal for CNPD oversight and consent practices in Luxembourg.
KDDI: 12.23M emails and 7.62M passwords compromised
On July 7, 2026, KDDI confirmed unauthorized access to ~12.233M emails and ~7.616M passwords from its ISP email platform—an emblematic supply chain case with lessons for European companies.
CNPD 2025 report: 846 complaints (+40%), key takeaways for Luxembourg
CNPD 2025 annual report: 846 complaints (+40% in one year), 425 breach notifications (49% human error), 59 investigations, 16 opinions. The shift to risk-based regulation, AI as a priority, and 5 concrete actions for DPOs and CISOs in Luxembourg.
Nextcloud: 367,000 records exposed (invoices, emails, scripts)
Cybernews reports an exposed Nextcloud ElasticSearch database with ~367,000 records (~8 GB) of staff and clients: invoices, emails, and scripts. The exposure was closed on May 27, 2026.