Authority
ICO
Country
United Kingdom
Date Issued
February 20, 2023
Industry
Education
Summary
An unauthorized third party exploited a known vulnerability in Sitefinity software to conduct a brute-force attack and upload malicious code to CISI's website checkout page, capturing payment details and personal data of approximately 3,883 UK data subjects. The organization was running unsupported software, which contributed to the security failure.
Violation Types
Data BreachSecurityData Subject Rights
Articles Violated
Related Enforcement Actions
Avoid enforcement risk with automated compliance
IQWorks helps organizations automate UK GDPR compliance before regulators come knocking.
Talk to an Expert