Security failures can turn routine data collection into lasting harm. Public findings help distinguish documented control failures from speculative risk.
A Facebook design flaw allowed attackers to obtain access tokens affecting about 29 million accounts. The regulator found failures in breach notification, documentation and data protection by design.
View caseMeta notified the regulator that some social-media user passwords had been stored in plaintext on internal systems. The inquiry assessed notification, documentation and security obligations.
View caseThe board reviewed the 2023 compromise of Microsoft Exchange Online and described operational and strategic security decisions that allowed the intrusion to succeed and remain undetected.
View caseThe FTC alleged that Ring gave employees and contractors broad access to customers’ videos and failed to implement basic security measures, enabling account takeovers and harassment.
View caseThe inquiry followed the publication of a dataset containing Facebook users’ personal data that had been scraped from the service. The DPC examined whether Facebook Search, Messenger Contact Importer and Instagram Contact Importer had been designed and configured in line with data-protection-by-design and default requirements.
View caseThe DPC examined twelve Facebook data-breach notifications received during a six-month period in 2018. It found that Meta Platforms Ireland failed to put appropriate technical and organisational measures in place that would allow it to readily demonstrate how it protected EU users’ data in the context of those breaches.
View caseA government-commissioned data protection impact assessment documented risks in diagnostic data sent by enterprise versions of Office and proposed measures for public-sector use.
View caseThe FTC alleged that Microsoft made false or misleading statements about privacy and security in Passport, Passport Wallet and Kids Passport. The complaint addressed undisclosed collection, claims about purchase security and failures to implement reasonable procedures for preventing, detecting and auditing unauthorised access.
View case