Car sale leads to major data breach on Lithuanian insurance platform

A Kaunas resident has raised serious concerns about data security after a car sale led to unauthorized access to his extensive insurance history via the "Edrauda" online platform. The individual, who had used the platform for about ten years, found that the buyer of a company car could view all his insurance policies, including those for family members and company vehicles.

The incident occurred after the sale of a company car. When the buyer sought to arrange insurance, the seller suggested using "Edrauda." The next day, the buyer contacted the seller, stating he could see all of the seller's policies. Screenshots provided by the buyer reportedly showed not only data related to the sold car but the seller's complete insurance history, accumulated over a decade.

This situation has prompted an investigation by the State Data Protection Inspectorate (VDAI). Inga Mauricienė, an advisor at the VDAI's Legal Department, indicated that the case suggests illegal personal data processing. According to the General Data Protection Regulation (GDPR), a data breach includes accidental or unlawful loss, destruction, alteration, disclosure, or unauthorized access to personal data. The VDAI is examining whether contractual issues between the insurer and the insured, or other legal acts, were mishandled during the vehicle sale process, potentially leading to this breach.