Slimpay left a fraud-research server open for years; CNIL fined it EUR180K

Slimpay, a French payment institution for recurring SEPA payments, reused real debtor data in 2015 for an internal anti-fraud research project. When the project ended in July 2016, the copied data stayed on a server without access controls and could be reached from the internet.

A merchant customer alerted Slimpay on February 14, 2020. CNIL's decision says the exposed records covered about 12 million unique debtors and included names, contact details, BICs and IBANs. The authority also found weak logging and inadequate contracts with some downstream processors.

On December 28, 2021, CNIL imposed a EUR180,000 fine for failures around processor contracts, data security and communicating a breach to individuals. The mistake was not the research idea itself; it was letting a temporary experiment become an unmanaged public data store.

CNIL imposed a EUR180,000 fine after data for about 12 million unique debtors, including IBAN and BIC data, was left accessible.

The anti-fraud project used real payment data rather than a minimized or anonymized dataset.

The server was not retired when the research work ended, so the risk persisted for years.

Access to the server was not subject to satisfactory restrictions, and CNIL found no adequate access logging.

Processor oversight was incomplete, with some contracts missing mandatory GDPR clauses.

Test data needs an owner and an end date. A research server that uses production data is production risk, even after the project ends.

Slimpay isolated the server after the February 2020 alert and notified CNIL. The public CNIL decision was later anonymized, but CNIL's sanctions table still records the December 28, 2021 payment-institution case and the EUR180,000 penalty; GDPR Enforcement Tracker identifies the company as Slimpay.