Cybersecurity Policy Report, Estonian Firm Faces Fine for Data Protection Failures, (Sep 8, 2025)
By Tony Foley
Estonia’s Data Protection Inspectorate (DPI) has fined pharmacy and hospital products importer Allium UPI 3 million euros ($3.52 million) based on its failure to properly secure information collected in its Apotheka loyalty program as required by the EU General Data Protection Regulation (GDPR), leading to a data breach in 2024.
In a news release Friday, the DPI said that an investigation of Allium after the breach revealed that the company did not implement basic cyber hygiene and data protection measures, resulting in unauthorized persons repeatedly accessing its information systems and downloading a large amount of sensitive customer data. Specifically, the breach involved the personal data (including names, ID numbers, gender, and e-mail and home addresses, among other items) and purchase history of more than 750,000 customers that joined the loyalty program between 2014 and 2020.
DPI found that Allium did not implement multifactor authentication, and that one personal administrator account was used by several people with the same username and password. In addition, DPI said that Allium’s activity log monitoring was inadequate and that its database backups were stored insecurely. Finally, the company failed to clearly define the roles and responsibilities of personnel charged with ensuring data protection.
“If a company’s business model relies on processing customer data, protecting it must be an integral part of the business model,” said Pille Lehis, director general of the DPI. “Every company that customers trust with their data has an obligation to protect it and keep it secure. If a company fails to do so, it jeopardizes the privacy and trust of its customers.”
The amount of the fine was based on the scope of the breach, the sensitivity of the leaked data, the number of individuals affected, and the company’s annual turnover. Allium has 15 days from the date of the decision to appeal it.
News: LitigationEnforcement DataSecurity DataBreach GDPR DataPrivacy