13 ms·
Booking.com fined €475k for reporting data breach too late
- thitcanh 6y agoFull credit card details were leaked; The 72 hour window is reasonable. I’d go as far as forcing them to contact the banks of those cards as well.
- tijmendj 6y agoAs far as I know there is no legal basis for them to contact the banks, at least under GDPR. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is there to enforce GDPR and will not add additional requirements.
- thitcanh 6y agoRight, my suggestion is that it should. Yahoo’s settlement included identity protection or something along those lines. Disclosure to the customer might not always be enough.
- zaarn 6y agoNotifying banks will likely be required by their payment processor, not by the GDPR, those are two separate processes.
- villgax 6y agoWhen are countries & users going to fine FB for leaking data? It's such a boring dystopia that the only response they have is "it's from 2019", like WTH?
- johannes1234321 6y agoAs soon as the respective agencies analysed it and get to it. This doesn't happen over night, but is a more complex process which will quite certainly happen.
- deleted 6y ago[deleted]
- bhaavan 6y agoIt may be a boring dystopia, but, you can't be fined for the same crime over and over again, can you? https://www.dw.com/en/facebook-data-on-millions-of-user-accounts-leaked-online-in-latest-breach/a-57095637 https://www.dw.com/en/facebook-data-on-millions-of-user-acco...
- zaarn 6y agoGDPR violations aren't a crime. You can be fined multiple times for the same issue if you, for example, are being a complete ass towards the DPA or you refuse to fix underlying issues.
- zaarn 6y agoFB is being blocked by the Irish DPA, since EU FB is HQ'd there. Sadly this one loophole made it into the GDPR, so the other DPA's can only forward to the Irish agency for FB issues.
- not1ofU 6y agoStill waiting for Expedia to own up to their breach, since way before 2019. (source: ex-employee)
- dx034 6y agoThe SEC has a whistleblower program. A material breach of a public US company is definitely of interest to them.
- not1ofU 6y agoI am not sure I am in a position to report it. I dont have too much detail other than it was Ubquiti levels of "ownage" Surely the SEC can see (or be made aware of) comments like this and start their own investigations, no?
- H8crilA 6y agoThey have a $100B enterprise value, and make ~$4B/year in GAAP income. This is not even the yearly cost of a higher level lawyer. If you make $200k/year then the fine would correspond to a $30 ticket. Lol, just lol.
- matkoniecz 6y agoWell, at least it is progress from no fines at all or 1000$ fines. Still, should be 10 or 100 times more.
- hyperman1 6y agoIt's a number that will cause them to sit up and take notice, without starting a multi-year legal war. It signals to booking.com and other companies that the regulator is not asleep. The implicit threat is: fix your behaviour, everyone, or worse fines will follow. To be honest, I can live with that.
- matkoniecz 6y agoI also would be fine as long as "or worse fines will follow" is true. I would consider as desirable that egregious, systematic and catastrophic security failures would be resulting in fines and penalties large enough to bankrupt companies[0]. But starting from that is rather not a good idea, I agree that some warning is a good idea. [0] for example 2000$ for every single leaked address that they deliberately collected (if company is scared: then they should not ask user for address data! Companies very rarely actually need it, and they still ask.).
- zaarn 6y agoFor catastrophic failures the fines certainly become very large very quickly. And follow up fines if behaviour isn't changed do go up as well. So far, it's usually the former as most companies adjust by their first fine.
- kqvamxurcagg 6y ago
- orangepanda 6y ago> it is important to note that hotels inadvertently provided their Booking.com account login details to online scammers, there was no compromise of the code or databases that power the Booking.com platform. Interesting precedent. The platform is responsible not just for their own security practices, but also their users' security practices.
- another-dave 6y agoOn the other hand, if we consider the hotels as just a "user", why would they have access to full CC details, including security code. As someone booking a hotel on the site, I would expect booking.com to take responsibility for keeping my payment details secure (or, if they want to operate like a marketplace, make it clear that they're not taking responsibility, but in that case it looses a lot of value toe as an end user)
- avereveard 6y ago> why would they have access to full CC details, including security code. yeah I stopped using booking because of this. an hotel decided that the card used for reservation was the one to charge for my stay and charged it the day of arrival and I only discovered later when trying to reserve a rental car and I hit my card limit and couldn't. that pissed me off in so many ways, first because the booking wasn't a upfront pay but hotel did it anyway, second because booking disclosed my cc details to a third party instead of being a neutral escrow, and third of course because it bite me in the ass at the worst possible moment, as my car broke down and I needed to cover a rental and repairs while sorting out the rest of the travel.
- jiofih 6y agoSounds like you have a habit of not reading terms. For as much as I loath Booking, pay-on-arrival is clearly stated, and there is no escrow because you’re paying the hotel directly.
- avereveard 6y ago
- nodelessness 6y agoThey make that in probably the time I took to write this comment. Source: used to work there.
- lifeisstillgood 6y agoWell worth looking at Troy Hunt's views on this (from 2017) https://www.troyhunt.com/data-breach-disclosure-101-how-to-succeed-after-youve-failed/ https://www.troyhunt.com/data-breach-disclosure-101-how-to-s...
- turbinerneiter 6y agoWhy do companies even store user data? Any purchase I make, the shop needs my address and my payment info. It's always the same. Every browser can autofill it, if they bothered using the correct forms. Once the transaction is done, the invoice mailed and the product shipped - there is 0 need for this data to still be stored in their database. -> Address and payment info - browser auto fill -> purchase history - invoice via mail I used to be heavily biased to buy from Amazon, since it is basically one click. But lately, I'm more and more buying from smaller online shops which provide checkout without user account. I'm sure there is many things where you need to store user data, but also, there is definitely more things were user data is stored although it is not needed. And ultimately, that is the spirit of GDPR - ask yourself if you really need to store that data.
- 02thoeva 6y agoI'd expect that the name and address will still be stored in their payment processor. Then the invoice itself (containing your name/address/payment method) will need to be stored by the company in some form for accounting regulations.
- nodamage 6y ago> Once the transaction is done, the invoice mailed and the product shipped - there is 0 need for this data to still be stored in their database. This data can often still be necessary for legal and/or tax purposes.
- chrisacky 6y agoBCOM are not processing the payment here. They provide a "Hotel Login" which then let's the hotels view (upto N times) the raw card information of the guest for use internally on their own payment processes. There's various approaches that they make available, this is one of a few. More recently Booking.com started to move away from providing the raw card information and instead providing a virtual card which "Activiation" date only becomes enabled once the cancellation policy for the guest booking kicks in (allowing the hotel to charge before arrival). There's also an API approach, but the leading way to get access to the card/payment information __because__ BCOM are not merchants here is to provide this to the merchants/hotels through a BCOM login page. Reading between the lines, this is what I think was exposed.
- ai_ja_nai 6y agoWasn't the GDPR supposed to award fines in the range of millions?
- Hamuko 6y agoIt can but it doesn't require the fines to be in the millions. AFAIK there are 21 GDPR fines that are in the millions of euro.
- M2Ys4U 6y agoProportionality is a big concept in EU law, and it's explciitly written in to the GDPR. Article 83 ("General conditions for imposing administrative fines") states that: > Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article [...] shall in each individual case be effective, proportionate and dissuasive. SAs can't just hand out big fines for the sake of big fines. If a fine is issued then the SA's ruling can be challenged on the basis of proportionality.
- cik 6y agoThis is an effective non-fee for an entity their size. I'd assume we see the associated negative pattern - there's little real legislation impact, meaning there's little value in reporting, when examined economically. Were the fine larger, or more severe the reverse message would be sent. From a certain (not my) point of view poor compliance was just incentivized.
- libertine 6y agoWell, it's better then nothing I guess? This is a fine for failing to report a breach after 22 days (not for the breach itself), of around 4000 users. Though I agree it could be higher for these organizations, it's also not a small fine just to fail to report.
- ghego1 6y agoAccording to Regulation 679/2016/EU, aka the GDPR, fines could be much higher. Up to 4% of the total worldwide revenues (revenues, not profits). Moreover, repeated violations is expressly a parameter for higher fines. So non compliance as a strategy is not really viable.
- Someone 6y agoI disagree. Even in a company the size of Booking, top management cannot think “it’s only half a million”. I expect some manager will get a strongly-worded message about their department costing the company half a million because they waited too long before reporting the breach. That department, likely, will also see bad evaluations. I also expect Booking will use this case as an example to all other departments. And that’s ignoring the fact that, if Booking doesn’t change, and something similar were to happen again, the fine likely would be higher.
- cik 6y agoOne can easily think it's only half a million. That number while large for many organizations, isn't for others. Simply put, it's cheaper to pay this fine than build out the (likely) necessary compliance team. Were the fine commensurate with income I think it would go further.
- batmaniam 6y agoDoes this breach only affect users in the EU, or also in the US?
- cainxinth 6y agoMatt Taibbi said something during the 2008 financial crisis that has always stuck with me, paraphrasing: “Look at the figure a corporation pays in a fine to a regulator, multiply it by 10, and you’ll have roughy the amount they profited from their misdeed.”