Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
Microsoft: cryptominer via SEO/AI — EDR/XDR and NIS 2 in action
Microsoft disclosed an active cryptomining campaign spread via SEO poisoning and AI recommendations. Here’s how an EDR/XDR stack detects, contains, and evidences compliance with NIS 2 and DORA.
CNPD 1FR/2025: how the DPA calculates a GDPR fine in 5 steps
On 6 January 2025, the CNPD fined a controller for delays in data subject rights and applied the EDPB’s five-step method. Key takeaway: track and document your “time-to-rights”.
ICO recovers £118,852 from two former RAC employees
On 4 June 2026, the ICO secured confiscation orders totaling £118,852.32 against two former RAC employees for illegally selling nearly 30,000 lines of motorists’ data, underscoring increased post-conviction use of POCA powers.
Magecart 1×1 SVG skimmer on Magento: DLP and GDPR compliance
Sansec reveals a credit-card skimmer hidden in a 1×1 SVG targeting ~100 Magento stores, exfiltrating to 23.137.249.67. Here’s how well‑tuned DLP addresses GDPR Articles 32 and 44‑49.
GDPR Article 6: the Poste Italiane fine clarifies legitimate interest vs consent
Italy’s DPA fined Poste Italiane/PostePay €12.5m for intrusive device access via apps without a valid legal basis. Key message: anything beyond what is strictly necessary often requires valid consent, not legitimate interest.
WFP Gaza: warning for your enrollment portals (600,000 households)
On 2 June 2026, the WFP confirmed its self‑registration app in Palestine was compromised: data of ~600,000 Gaza households (names, IDs, mobiles, location) exfiltrated. Breach dated 14 May.
Charter: 4.9M emails exposed — phishing‑resistant MFA is now essential
A vishing attack abused a Microsoft Entra account to exfiltrate customer data from Salesforce. FIDO2/WebAuthn MFA is now the state of the art expected by GDPR Article 32.
Workplace video surveillance: the Hanako case rules out consent
Italy’s Garante (12/03/2026) fined Hanako s.r.l. for in-store video surveillance without proper notice and labor authorization. EU-wide message: in employment, employee consent is not a convenient legal basis.
Dashlane: fewer than 20 vaults copied — lessons from a 2FA attack
On May 31, 2026, a brute-force campaign targeting 2FA allowed attackers to copy encrypted Dashlane vaults from “fewer than 20” users. Here’s what this means for your IAM controls and GDPR/NIS 2 obligations.
French Council of State 2026 — Health Data Hub: DLP impact and EU transfers
The French Council of State (20/03/2026) upholds CNIL’s authorization for Health Data Hub on Microsoft Ireland in France and confirms no transfers outside the EU. A well‑configured DLP proves and enforces these flow limits technically.
Art. 35 GDPR: AEPD vs AENA, €10,043,002, deficient DPIA
On 4 March 2026, the AEPD fined AENA €10,043,002 for a non‑compliant DPIA on biometric boarding. Key takeaway: a “pro forma” DPIA is tantamount to no DPIA.
ILR — NIS 2 guidelines for governing bodies (17/02/2026)
ILR reiterates the 24‑hour early warning via SERIMA, then 72 hours and 1 month. See how a managed SOC/SIEM helps meet NIS 2 deadlines without stress.