Hora Credit IFN S.A, a Romanian non-bank credit operator, has been sanctioned by the country’s data protection regulator for failing to safeguard personal information following a significant security breach. The National Authority for Personal Data Protection (ANSPDCP) issued a €10,000 fine against the company after determining that it violated the General Data Protection Regulation through inadequate handling of a cyber-attack that compromised sensitive data.
The breach exposed personal information belonging to a substantial number of individuals, including current clients, former clients, employees, and business collaborators of the credit operator. The incident triggered an investigation by Romania’s data protection authority, which examined the company’s security practices and response procedures following the unauthorized access to its systems.
Regulatory Findings on Security Deficiencies
The ANSPDCP’s investigation concluded that Hora Credit had failed to implement sufficient technical and organizational security measures to protect the personal data under its control. Under GDPR requirements, organizations handling personal information must establish and maintain appropriate safeguards proportionate to the risks associated with data processing activities. The regulator determined the company fell short of these obligations, leaving client and employee information vulnerable to unauthorized access.
Data protection authorities across Europe have increasingly focused on cybersecurity practices as the frequency and sophistication of attacks targeting financial services companies continues to rise. Companies processing sensitive financial and personal information face heightened regulatory scrutiny regarding their ability to detect, prevent, and respond to security incidents. The ANSPDCP’s enforcement action reflects this broader regulatory trend emphasizing accountability for data protection failures.
Broader Context for European Fintech Sector
The fine represents part of a growing pattern of data protection enforcement actions affecting European financial technology companies. Regulators in multiple jurisdictions have issued significant sanctions against fintech operators and traditional financial institutions for GDPR violations related to cybersecurity failures and inadequate incident response procedures.
Romania’s fintech sector has experienced substantial growth in recent years, with companies like Hora Credit operating as non-bank credit providers serving consumer and business borrowing needs. However, this expansion has drawn regulatory attention to security standards across the industry. Data protection authorities view proper cybersecurity implementation as fundamental to maintaining consumer trust and protecting market integrity.
The incident underscores the importance that European regulators place on cybersecurity governance within the fintech ecosystem. Companies handling financial data and personal information face mounting pressure to invest in robust security infrastructure, staff training, and incident response capabilities. The €10,000 penalty serves as a reminder that regulatory authorities will hold organizations accountable when security failures result in data compromises, regardless of the underlying cause of the breach itself.