Supermarket Chain Fined for Breaching Data Security Duty

The facts are as follows. In November 2020, the DPA became aware of a security breach in Cencosud’ s computer systems from a computer attack known as “Egregor ransomware.”

During the investigation, the DPA also found a second security incident by which Cencosud clients received fraudulent emails aiming at deceiving users and obtaining additional personal data from them.

Therefore, the DPA requested that Cencosud confirm the occurrence of the security breach and, if confirmed, (i) to detail the measures adopted by the company to mitigate any damages and prevent future incidents; (ii) to report whether there was indeed a leak of personal data of Argentine data subjects; (iii) to explain the measures adopted to guarantee the security and confidentiality of the data; and (iv) to report the existence of ongoing judicial or criminal procedures related to the incident.

Cencosud replied that it effectively had suffered a malware that had slightly affected its Argentine infrastructure, confirming there was no damage. In addition, the company claimed to have implemented new measures for vulnerability management.

The DPA considered Cecosud’s response to be insufficient, noting that the company did not implement the necessary security measures to prevent and manage security incidents under Resolution No. 47/2018 and article 9 of the PDPL.

Thus, the DPA fined Cecosud for AR$ 290,000 for (i) failing to take the preventive technical and organizational measures to guarantee security and the necessary corrective measures to fulfil its  security duties; and (ii) failing to notify its clients that they could be victims of personal data leaks on either occasion. The decision was included in the Registry of PDPL Infringers.