The Readable Bucket: Awareness, 72 Hours and Who Gets Told
Nordwind is an online retailer. At 11:00 on a Friday it confirmed that a cloud storage bucket had been publicly readable since 3 March. The bucket held 120,000 customer records: names, delivery addresses, bcrypt password hashes, and 4,000 order notes naming a medical device. A security researcher had emailed the generic support inbox at 09:00 on Thursday; the ticket sat unread until Friday morning. Nordwind's cloud provider says it noticed the misconfiguration on Monday but, as a processor, 'left it to the customer'. Nordwind's head of security wants to log the matter internally only: the passwords were hashed, no payment card data was exposed, and the researcher published nothing. Nordwind has a DPO and 40 staff in its Berlin office.
1. When did Nordwind become aware for the purposes of Article 33(1), and what is its notification deadline?
Read the worked answer
Awareness, not completed investigation, starts the clock.
Article 33(1) requires notification 'without undue delay and, where feasible, not later than 72 hours after having become aware of it'. A controller becomes aware when it has a reasonable degree of certainty that a security incident has occurred which led to personal data being compromised; mere suspicion is not enough.
Here the researcher's email arrived at 09:00 on Thursday in a monitored generic inbox. That is arguably the point of awareness, because a controller must have an escalation route for exactly this kind of report. At the very latest awareness crystallised at 11:00 on Friday when the exposure was confirmed. The safer, defensible position is Thursday 09:00, producing a deadline of Sunday 09:00.
Supporting points:
- The notification need not be complete; Article 33(4) permits phased notification, and any delay must be explained under Article 33(1);
- The Article 33(5) breach register is mandatory whatever is notified;
- The fact that the researcher published nothing affects severity, not whether a breach occurred.
2. What is the position of the cloud provider, and does its conduct affect Nordwind's own obligations?
Read the worked answer
The processor has its own duty and appears to have breached it.
Article 33(2) requires a processor to notify the controller without undue delay after becoming aware. The provider noticed on Monday. 'We left it to the customer' is not compliance, and Article 28(3)(f) separately requires the processor to assist the controller in ensuring compliance with Articles 32 to 36.
The controller's duty is not displaced by the processor's failure. A supervisory authority will not accept 'the vendor was at fault' as an answer. Nordwind should:
- Record the full timeline, including the processor's late notice, in the Article 33(5) register;
- Review the Article 28 contract for security, notification and audit clauses;
- Assess whether the processor's conduct justifies termination or replacement under Article 28(3)(h).
Accountability under Article 5(2) makes the controller answerable for its processor's silence as a governance failure, not just as the supplier's mistake.
3. Is the head of security right that no individuals need to be informed under Article 34?
Read the worked answer
No - the assessment is under-reacting.
Article 34(1) requires communication to data subjects when a breach is likely to result in a high risk to their rights and freedoms. The Article 34(3)(a) exemption applies only where the data have been rendered unintelligible to unauthorised persons, typically through state-of-the-art encryption.
bcrypt hashes are not encryption. They slow down offline password cracking but they do not hide the records: names, delivery addresses and 4,000 health-related order notes were in plaintext and publicly readable for weeks. Public readability means actual or presumed access cannot be excluded, and 'nobody published it' is irrelevant to the risk assessment.
The risk should be segmented:
- For the 116,000 records without health notes, identity and phishing risk is moderate but real (address plus email plus password reuse);
- For the 4,000 records naming a medical device, combining an identifiable person with a health inference is likely to be high risk and clearly warrants direct communication in clear and plain language, with advice on phishing and credential hygiene.
Finally, Articles 33 and 34 run in parallel: notifying the authority does not satisfy Article 34, and vice versa.