Virgin Mobile Polska data breach

On 2 January 2020, Virgin Mobile Polska, a Polish mobile virtual network operator, informed customers that an unauthorised person had accessed the personal data of subscribers by exploiting a flaw in the company's prepaid-service registration system. The case became one of Poland's most-cited GDPR enforcement actions.

What happened

Virgin Mobile Polska's IT system was designed so that data exchange between internal applications would occur only after verifying certain parameters drawn from prepaid customers' registration applications — a check meant to confirm that any request to transfer data came from an authorised entity. In practice, that verification did not work, and the mechanism had never been properly tested before deployment.

An unauthorised party discovered the broken verification logic and used it to extract subscriber records — essentially abusing an application loophole rather than breaking encryption or stealing credentials. The operator detected the breach in December 2019 and notified the Polish supervisory authority (UODO) on 18 December 2019.

Impact

• The personal data of 114,963 subscribers was accessed.
• Exposed fields included names, PESEL national identity numbers, ID-card series and numbers, telephone numbers, and NIP tax identifiers.
• Because PESEL and ID-card data underpin identity verification across Polish banking and government services, affected subscribers faced an elevated identity-theft risk.

Regulatory outcome

On 3 December 2020, UODO imposed a fine of PLN 1,968,524 (about EUR 460,000) on Virgin Mobile Polska. The regulator's core finding was not the breach itself but the company's failure to regularly and systematically test, measure, and evaluate the effectiveness of its technical safeguards — a direct breach of GDPR's "security of processing" and accountability principles. After the operator challenged the decision and a court remanded it, the supervisory authority re-examined the case in 2023 and again concluded the measures had been inadequate.

Why it matters

The Virgin Mobile Polska case is a landmark interpretation of GDPR Article 32: regulators made clear that ad-hoc or incidental security reviews do not satisfy the requirement for regular testing of technical measures. For telecom operators handling national identity numbers at scale, the decision underscored that untested application logic is itself a compliance failure — the absence of a known exploit does not excuse the absence of proactive security validation.