The Data Protection Inspectorate (AKI) imposed a large fine on Allium UPI OÜ, the company managing Apotheka's loyalty program. The fine amounts to three million euros. The company did not adequately protect its customers' data.
The security issue occurred at the beginning of 2024. The investigation revealed that Allium UPI did not use basic security measures. Unauthorized individuals gained access to customer data. The leaked data included personal information such as names, personal identification codes, phone numbers, and addresses. Additionally, purchase history was leaked, which contained information about health and intimate life.
Allium UPI did not use several important security measures. For example, multi-factor authentication was missing. Multiple people also used the same administrator account. Database backups were stored insecurely.
AKI Director General Pille Lehis stated that the protection of customer data must be very important for the company. Allium UPI did not properly protect the data. This endangered the privacy of hundreds of thousands of people.
AKI lawyer Jekaterina Aader added that AKI's task is to protect individuals whose data has been leaked. The purpose of the fine is to compel companies to improve their security systems.
The size of the fine was determined taking into account the extent of the violation, the sensitivity of the data, and the company's turnover. The decision was made based on European Union rules. The fine decision has not yet come into force. The company has 15 days to contest it.