Romania

Auchan România S.A.

8,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2026-10-30.

Rank · Sector

#276

of 658 in Industry and Commerce

Rank · Romania

#63

of 302

Rank · All fines

#1,641

of 3,275

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2026-10-30
Controller / Processor: Auchan România S.A.
Sector: Industry and Commerce
Quoted Articles: Art. 32 (1) b), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 8,000 on Auchan România S.A. Following the controller's breach notification, it was found that attackers had accessed the administrator account of one of the controller's security systems. The malicious third party then accessed and disclosed the personal data of a number of internal users, including usernames, names, email addresses and passwords. Had the controller implemented adequate secure-access requirements for their systems, the risk of unauthorised access would have been reduced.

Open original source Links to the regulator's original publication or another source.