Romania

HORA CREDIT IFN S.A.

10,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2026-11-11.

Rank · Sector

#222

of 345 in Finance, Insurance and Consulting

Rank · Romania

#56

of 303

Rank · All fines

#1,558

of 3,280

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2026-11-11
Controller / Processor: HORA CREDIT IFN S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 32 (1) b), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 10,000 on HORA CREDIT IFN S.A. The controller reported a cybersecurity incident to the relevant authority. The attackers had gained access to the personal data of a large number of data subjects. The accessed documents contained email correspondence, as well as other documentation and contracts relating to former and current customers and employees. It was found that the controller had not implemented adequate security measures for personal data.

Open original source Links to the regulator's original publication or another source.