The attack on the VwbP constitutes a personal data breach within the meaning of Article 33 of the General Data Protection Regulation (GDPR). The crisis unit is working urgently to ensure that the data subjects are informed of the breach of the protection of their data as quickly as possible in accordance with Article 34 GDPR.

However, since not all contact details – for example, residential addresses – are stored in the register, the legal entities are now being informed of the incident and asked to inform the affected data subjects. As a result, no further data going beyond the Anti-Money Laundering Directive will flow to governmental bodies.