ANSPDCP (Romania) - Fine against GEROCOSSEN S.R.L.
Romanian DPA fines cosmetics retailer €5,000 for inadequate security measures leading to data breach.
Run GEROCOSSEN S.R.L.?
Get an email when a reviewed story names GEROCOSSEN S.R.L., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) imposed a €5,000 fine on GEROCOSSEN S.R.L., a cosmetics retailer, for violating Article 32 GDPR by failing to implement adequate technical and organizational security measures. A cyberattack on the company's IT infrastructure exposed personal data including identification and contact details. The DPA ordered corrective measures including access monitoring, logging systems, 30-day log retention, and backup procedures.
The lesson from this incident
Full lessonGEROCOSSEN S.R.L. failed to implement the baseline technical and organizational security measures required by GDPR Article 32, leaving customer personal data — including identification and contact details — exposed during a cyberattack. The absence of adequate access monitoring, logging systems, and backup procedures meant the company could neither detect the intrusion early nor recover effectively. This case underscores that GDPR compliance is not just about data collection policies but demands active, operational security controls. Regulators increasingly expect organizations of all sizes to demonstrate measurable security maturity, and failure to do so carries both financial and reputational consequences.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.