[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f87y50TPypQNPEjWxTP2NYmxtNs61y5rdVw1yfVSKSuo":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"55d626e7-e0b1-4d48-ac5b-ef84064545cc","AEPD (Spain) - PS-00028-2026","aepd-spain-ps-00028-2026-9236f7","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS-00028-2026 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00028-2026.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Investigat...\" Show changes","The Spanish Data Protection Agency (AEPD) has fined the Spanish Cycling Federation €4,800 for a data breach that compromised the personal data of 261,965 individuals. The breach, which lasted at least two months, resulted from inadequate security measures, including insufficient access controls, lack of multi-factor authentication, and weak detection mechanisms, violating Article 5(1)(f) of the GDPR.","Spain's AEPD fines cycling federation €4,800 for data breach affecting 261,965 individuals.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00028-2026&diff=53444&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-10-16T14:08:15+00:00","2026-10-16T16:00:13.022243+00:00",7,[17,20],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"platform","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":49,"vendors":126},[50,79,100],{"slug":51,"name":52,"problem":53,"products":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[84,92],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":101,"name":102,"problem":103,"products":104},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[105,110,118],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":106,"product_name":107,"url":108,"description":109},"sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":144},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","The Spanish Cycling Federation suffered a prolonged data breach lasting at least two months, exposing the personal data of nearly 262,000 individuals due to weak access controls, absent multi-factor authentication, and inadequate detection mechanisms. The core failure was a combination of insufficient technical safeguards and a lack of timely detection, allowing the breach to persist far longer than it should have. This directly violates GDPR Article 5(1)(f), which mandates appropriate security of personal data through integrity and confidentiality controls. The case demonstrates that even smaller sports federations handling large volumes of member data must implement enterprise-grade security measures proportionate to the sensitivity and volume of data they process.",[132,133,134,135,136,137,138,139,140,141,142,143],"GDPR Article 5(1)(f) - Integrity and Confidentiality","GDPR Article 32 - Security of Processing","GDPR Article 33 - Notification of a Personal Data Breach","CIS Control 5 - Account Management","CIS Control 6 - Access Control Management","CIS Control 8 - Audit Log Management","NIST SP 800-53 AC-2 - Account Management","NIST SP 800-53 AC-3 - Access Enforcement","NIST SP 800-53 IA-5 - Authenticator Management (MFA)","NIST SP 800-53 SI-4 - Information System Monitoring","ISO\u002FIEC 27001:2022 - A.8.3 Information Access Restriction","ISO\u002FIEC 27001:2022 - A.8.5 Secure Authentication",{}]