Lawyers are getting active – leakage of registration data at GIS has legal consequences

The Federal Bureau of Investigation (BK) in Vienna announced last week that a Dutch hacker – krone.at reported – had been arrested on suspicion of stealing nearly nine million Austrian registration details in 2020 and offering them for sale on the internet. The theft is said to have been made possible by a breakdown at the Viennese IT company, which had ordered GIS to restructure its database. A company employee had used the real registration data from the GIS for a test, which was therefore available on the Internet without access protection.

Has data been sold more often?
According to the two lawyers, it is unclear whether the hacker had resold the data before BK detectives secretly obtained it. This is how the criminals tracked down the perpetrator, which eventually led to his arrest. “Thus, all Austrian citizens and companies could be affected by the data incident,” the lawyers wrote.

There was criticism of the information policy: “According to the provisions of the EU General Data Protection Regulation (GDPR), data subjects must be informed immediately in the event of a data protection breach. It is currently still unclear why the Austrian population is only aware of the extensive media attention of January 25, 2023 was made aware of the scope of the data breach. This is all the more surprising because, according to the researchers, the relevance of registration data in the wrong hands should not be underestimated,” the lawyers emphasized. GIS responded to the matter in May 2020. At that time, however, the extent of the data theft was barely known.

GIS rejects allegations in a statement
The GIS rejected allegations in this regard in a statement: “After the data theft became known in 2020, the GIS, in close cooperation with the investigative authorities, immediately filed a report with the data protection authority and immediately informed the public through APA,” it said. . “The correctness of this procedure has been accepted by the data protection authority.”

The GIS could not inform individuals, “because it was unclear which and how many people were actually affected by the crime”. GIS Director Alexander Hirschbeck emphasized: “GIS attaches great importance to the highest security standards in data protection and also regularly has these confirmed by ISO certifications. Details of the ongoing investigations against the hacker are not known to the GIS. The GIS has not yet about the specific data that have been found about the perpetrator.”

Haupt and Scheiber warned that the registration data could be used for fraud, including identity theft. “Those affected can join the criminal proceedings against the hacker and claim possible compensation. In addition, those affected may be able to claim damages from the GIS and the still unknown IT company,” Scheiber and Haupt explained the purpose of the collection procedure. Damage caused by fraud using the reporting data should be borne by those affected, “unless you have already successfully filed your claims against those responsible for the data breach,” Scheiber and Haupt emphasized.

According to “Kurier”, Haupt has also filed a report against unknown persons on behalf of a client, owner of a carpentry workshop. It concerns the suspicion of illegal access to a computer system. However, the representation refers to the person in charge of the IT company on behalf of the GIS. “My client wants clarification, demands compensation and joins the process as a victim,” said Haupt.