E-Business
Meta Fined €91m for GDPR Violations in User Password Breach
Ireland’s Data Protection Commission (DPC) has announced a €91 million fine against Meta Platforms Ireland Limited (MPIL) following an inquiry into the company’s handling of user passwords.
This decision marks a significant development in the enforcement of the General Data Protection Regulation (GDPR), highlighting the importance of secure data handling practices by major tech companies.
The inquiry, which began in April 2019, was initiated after MPIL reported that it had inadvertently stored certain users’ social media passwords in plaintext on its internal systems.
Plaintext storage means the passwords were not encrypted or protected using cryptographic measures, leaving them vulnerable to unauthorized access.
Although the incident was contained within Meta’s internal systems and no external parties gained access to the passwords, the company’s failure to ensure proper security led to a series of GDPR violations.
Findings and Violations
The DPC’s investigation concluded that MPIL had breached several key provisions of the GDPR:
Failure to Notify the DPC of the Breach: MPIL violated Article 33(1) of the GDPR by failing to promptly inform the DPC of the personal data breach concerning the storage of user passwords in plaintext.
Failure to Document the Breach: According to Article 33(5) GDPR, MPIL failed to properly document the breach, which is required to ensure transparency and accountability in data handling.
Inadequate Security Measures: MPIL violated Article 5(1)(f) and Article 32(1) of the GDPR by not implementing appropriate technical and organizational measures to secure user passwords, leaving them susceptible to unauthorized processing.
These violations underscore the company’s inadequate response to the risks posed by insecure password storage and its failure to meet the regulatory standards set by GDPR.
Decision and Penalties
On September 26, 2024, the DPC issued its final decision, which included both a reprimand and a €91 million fine.
The decision was reached after the draft was reviewed by Concerned Supervisory Authorities across the EU/EEA, as required under GDPR’s Article 60. No objections were raised, confirming the widespread support for the ruling.
Deputy Commissioner Graham Doyle emphasized the severity of the incident, noting that “user passwords should not be stored in plaintext, given the risk of abuse.”
He stressed that the sensitivity of these passwords, which allow access to personal social media accounts, made it crucial for companies to implement robust security measures.
Series of Fines
This is not the first time Meta is facing fines under GDPR. In 2023, the company was hit with a massive $1.3 billion penalty for breaching EU data privacy regulations.
Additionally, in 2022, Meta was fined $276 million following a 2021 data breach that compromised the personal information of over 533 million users.
Transcorp Hotels Plc has delivered a stellar performance in the first half of 2025, recording a 60% year-on-year surge in revenue to ₦47.57 billion, up from ₦29.72 billion in H1 2024. Gross profit climbed 71% to ₦36.21 billion, maintaining a strong 76% margin despite inflation and operational headwinds.
The hospitality giant, a subsidiary of Transnational Corporation Plc, also announced an interim dividend payout of ₦1.024 billion — offering ₦0.10 per 50 kobo ordinary share to shareholders.
In a bold move, the company unveiled Nigeria’s largest corporate venue — the 5,000-seat Transcorp Centre — staking its claim as the new leader in event hospitality. Chairman Emmanuel Nnorom described the results as proof of Transcorp Hotels’ transformative strategies and unwavering investor commitment. MD/CEO Uzo Oshogwe attributed the success to relentless execution and a resilient business model.
Transcorp Hotels, renowned for iconic assets like Transcorp Hilton Abuja and its digital platform Aura, says it isn’t just leading Nigeria’s hospitality sector — it’s redefining excellence across Africa.
Chinese “threat actors” have hacked Microsoft’s SharePoint document software servers and targeted the data of the businesses using it, the firm has said.
China state-backed Linen Typhoon and Violet Typhoon as well as China-based Storm-2603 were said to have “exploited vulnerabilities” in on-premises SharePoint servers, the kind used by firms, but not in its cloud-based service.
The US tech giant has released security updates in response and has advised all on-premises SharePoint server customers to install them.
“Investigations into other actors also using these exploits are still ongoing,” Microsoft said in a statement.
The firm said it had “high confidence” the hackers would continue to target systems which have not installed its security updates.
It added that it would update its website blog with more information as its investigation continues.
Microsoft said it had observed attacks in which hackers had sent a request to a SharePoint server “enabling the theft of the key material by threat actors”.
Charles Carmakal, chief technology officer at Mandiant Consulting firm, a division of Google Cloud, told reporter, it was “aware of several victims in several different sectors across a number of global geographies”.
Carmakal said it appeared that governments and businesses that use SharePoint on their sites were the primary target.
A number of adversaries who stole material encoded by cryptography were then able to regain ongoing access to the victims’ SharePoint data, he said.
“This was exploited in a very broad way, very opportunistically before a patch was made available. That’s why this is significant,” Carmakal said.
Carmakal said the “China-nexus actor” was deploying techniques similar to previous campaigns associated with Beijing.
Microsoft said Linen Typhoon had “focused on stealing intellectual property, primarily targeting organizations related to government, defence, strategic planning, and human rights” for 13 years.
It added that Violet Typhoon had been “dedicated to espionage”, primarily targeting former government and military staff, non-governmental organizations, think tanks, higher education, the media, the financial sector and the health sector in the US, Europe, and East Asia.
Meanwhile, Storm-2603 was “assessed with medium confidence to be a China-based threat actor”.
National Identity Management Commission (NIMC) has issued a public warning that it is not associated with NINcard.com.
According to the commission, the website has been circulating online to offer services for Nigerians seeking National Identification Number (NIN) services.
NIMC, in a post on its official X account on Wednesday, said, “NINcard.com is not in anyway affiliated to NIMC. Stay vigilant!”
The warning was accompanied by screenshots of fake payment receipts and OTP request pages from the website, both of which were boldly stamped “FAKE” by NIMC to alert the public.
NIBBS: Banks Close 29.4m Accounts, Dormant Accounts Hit 33.39m
NDPC Hides MultiChoice Privacy Violation Details Despite FOI Request- FIJ
Cardoso, CBN Boss Risks Arrest over Alleged N5.2 Trillion Unremitted Funds
UK Businesses Look to Africa As Strategic Growth Partners
FG Plans N50m STEEM Grant to Support Student Innovation in August
Telecom2 days agoGlo Launches Nigeria’s First-of-its-kind Device Protection Plan
Telecom2 days agoTelcos: How and Why Network Services have Been Poor
Broadcasting2 days agoCanal+ Clears Final Hurdle to Acquire South Africa’s MultiChoice
E-Business2 days agoNIMC Warns Nigerians of Fake NIN Website
Telecom2 days agoMTN Executive Adeola Oduntan Emerges as Africa’s Supply Chain Leader of 2025
- Telecom2 days ago
MTN Nigeria Sweeps Africa’s Procurement Awards With Innovation and Impact
E-Business2 days agoMicrosoft Servers Hacked by Chinese Groups
Telecom2 days agoTelegram to allow U.S. users send, receive crypto directly in app