Company fined for personal data breaches

The State Data Protection Inspectorate (hereinafter referred to as the) SDPI) has imposed a fine of EUR 4,500 on UAB DELSKA Lithuania (the successor of UAB Rakrėjus) for breaches of personal data security.

The SDPI launched its investigation in March 2025 following the receipt of an alert of personal data breaches (PDB) related to a cyber security incident that occurred on the public cloud platform of Rakrėjus UAB.

Following the investigation, the SDPI found that the PDB compromised the security of personal data of a large number of data subjects (almost 3,000), prevented the recovery of part of the data, and disrupted the provision of services (including financial services) for a certain period of time. It qualified the breach as moderate. It was found that the inspected person had failed to implement sufficient technical and organisational security measures to prevent PDBs and thus breached the requirements of Article 32(1)(b) of GDPR.

The decision of the SDPI may be appealed in court within one month from the date of notification.