Last Saturday I received an email about the third confirmed data breach affecting my personal data 123, and I am glad about it. These notifications show that we have a problem in society: companies collect far too much sensitive data and the technical protective measures are not sufficient. From the entry into force of the GDPR in 2018 through 2025, I received no information about potential data breaches. Since August, there have been at least three unauthorized accesses to my data. Without statistics, we as a society cannot assess the risk.
The next step to protect our data will be to delete it when it is no longer required. I have not used my Google AdWords account for ten years, and my last order from ASOS was more than five years ago. Another cost-effective measure is to regularly review the technical and organizational measures (TOMs) agreed with external service providers. 8.8 million rows of Danish citizens’ data were copied through the account of a former employee of a two-person company 4. This measure, combined with API monitoring, could have prevented this data breach.
Finally, I expect investment in Database Activity Monitoring (DAM) solutions. These can report and block queries returning a high number of rows as well as other unusual behavior, reducing the unauthorized outflow of data. There are already products on the market at a fraction of the license and operating costs of the legacy market leaders, which require little storage space, cause only a slight performance loss, and have a simple and reliable architecture.
How do you feel when you learn about a data breach that affects your data? When will German companies start investing in the monitoring of sensitive data?
Photo taken by geralt from Pixabay
Email from Google about a security incident involving my old Google AdWords account on 08.08.2025 ↩︎
Email from ASOS on 10.10.2026 ↩︎
Email from La Touche Musicale on 02.10.2026 ↩︎
https://cybernews.com/security/denmark-cpr-data-breach-weak-password/ ↩︎