MyConnector Platform SRL, a Romanian startup operating a virtual and hybrid event platform, has been fined €6,000 by Romania’s National Authority for the Supervision of Personal Data Processing (ANSPDCP) following a significant security breach that compromised user personal data.
The Security Incident
The breach exposed sensitive information belonging to platform users, including names, email addresses, phone numbers, personal identification numbers, and identity document details. The incident resulted from the company’s failure to implement adequate security measures during the application testing phase.
A critical error in the company’s development practices created the vulnerability. Rather than using anonymized or synthetic data for testing purposes, MyConnector Platform SRL employed real user data in its test environment. This decision left genuine personal information exposed to unauthorized access by third parties.
The ANSPDCP’s investigation determined that the operator bore direct responsibility for the security lapse. In an official statement, the authority noted: “The operator did not implement appropriate measures for testing the MyConnector Platform application, which led to a third party gaining access to personal data such as email addresses, phone numbers, names, personal numeric codes, and identity document numbers.”
Regulatory Response and GDPR Implications
The €6,000 penalty reflects violations of the General Data Protection Regulation, Europe’s comprehensive data protection framework. While the fine may appear modest compared to other GDPR enforcement actions, it underscores the regulatory body’s commitment to enforcing data security standards across the Romanian startup ecosystem.
The case highlights a common vulnerability in software development workflows. Many technology companies, particularly startups operating with limited resources, may overlook the risks associated with using production data in non-production environments. This oversight can create significant compliance and security risks, potentially exposing millions of personal data records to unauthorized access.
Broader Implications for European Startups
The MyConnector Platform incident serves as a cautionary example for European SaaS companies navigating increasingly stringent data protection requirements. As the startup ecosystem continues to mature across the EU, regulators are placing greater emphasis on proactive security measures rather than reactive responses to breaches.
Companies operating in the event technology and collaboration software sectors face particular scrutiny, given that their platforms typically collect substantial amounts of personal data from attendees and organizers. Implementing robust data governance practices—including proper test data management, access controls, and security protocols—has become essential for regulatory compliance.
The fine also reinforces expectations that technology startups must treat data protection as a core business requirement from the earliest development stages, not as an afterthought. For Romanian startups in particular, this case demonstrates that the ANSPDCP remains actively engaged in monitoring compliance and enforcing penalties when violations occur.