Early in 2020 there has been a serious data leak at the car rental company Buchbinder according to media reports in the computer magazine c’t and the weekly newspaper Zeit. Personal data of three million clients have been leaked and are accessible (unencrypted) for anyone on the internet. According to the media all Buchbinder clients (car renters and drivers) from 2003 to 2020 are affected.

A configuration error on one of Buchbinder´s backup servers has apparently triggered the data leak. This lead to personal data being published on the internet. The following data has been published:

Name
Address
Date of birth
Mobile phone number
E-mail address
Driving licence number
Driving licence issue date
Payment information and bank details

The data was publicly available on the internet. The likelyhood of phishining attempts, blackmail and other fraudulent methods is considered to be very likely. Identity theft cannot be ruled out.

The disclosure of personal data is likely to constitute a serious breach of the GDPR (European Data Protection Regulation). According to Art 82 GDPR, any person who has suffered material or immaterial damage due to a data protection breach is entitled to claim damages against the responsible party, thus against Buchbinder.

The following cryptocurrency exchange services have been abused: BITSTAMP, JUBITER, BITPANDA, KRIPTOMAT, COINBASE and KRAKEN.

Unfortunately, it is extremely difficult to track down the cyber fraudsters in this way. For this reason, we now also offer investigations into cryptocurrency transactions with the help of external partners.

Ledger SAS had a major security breach in their online shop in the year 2020. The breach occured in their e-commerce and marketing database with over one million client email adresses and over 290´000 personal client information records. Since 2020, this information is available for everyone on the internet platform.

Ledger SAS clients have been massively affected since the publcation of their personal data on the platform. They receive a huge number of unsolicited advertising e-mails, phone calls from unknown third parties, as well as phishing e-mails and blackmail e-mails or calls almost daily.

Class action for those affected by the Ledger SAS data breach have been filled. It is to be assumed that Ledger SAS violated provisions of the European General Data Protection Regulation (GDPR). Ledger SAS is liable as a data protection controller and affected persons have a claim for damages. Ledger SAS has so far rejected an out-of-court settlement. For this reason, the first lawsuits have now been filed in court (initially in Germany).

The claim for damages asserted in this context due to the refusal to provide information about the data leak (which was in any case delayed) has not yet been ruled by the Innsbruck Regional Court. A preliminary ruling is awaited by the European Court of Justice (ECJ).

The judgments are not yet legally binging.