Re:NordVPN confirms it was hacked
by vianneychevalie on Monday October 21, 2019 @11:44AM
(#21313564)
They could argue that they don't have proof that the exposed private key led to a personal data breach.
Yeah, I think that's their only option actually.
They would have to be sure that no private data leaked though, right?
Re:NordVPN confirms it was hacked
by slantedview on Monday October 21, 2019 @12:22PM
(#21314098)
Exposing a private key is basically a breach.
"breach" usually has a legal definition, which varies by jurisdiction
If they have EU customers then article 33 of GDPR should see to that.
"In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay."
Unless the authorities in EU accept the explanation they are in trouble, but I think you shall report even if you think there has been a breach.