60,000 Euro fine against DÉCIMAS
Data protection violation due to insufficient security measures in SQL injection attack.

The Spanish data protection authority fined DÉCIMAS for a cyberattack in April 2024. An SQL injection compromised the personal data of over 330,000 customers, including names, email addresses and DNI numbers. The company only found out about the attack through INCIBE, which revealed inadequate monitoring measures. Originally, a fine of EUR 100,000 was imposed, which was reduced to EUR 60,000 by admission of guilt and timely payment.