Illegitimate Data Protection Requests - To Delete or to Address?

Privacy has become an asset for individuals and a target for cyber-attackers. However, there is an increasing number of instances where privacy by design is not sufficient as a stand-alone principle, in particular, due to the innovativeness of attackers. Have all organizations considered how this "new oil" will motivate cyber-attackers to come up with innovative exploitation scenarios? A new approach consists of pretending to submit an apparently valid data protection request with an attached executable file that represents their data subject access request, hiding, in reality, malware that is aimed at gathering credentials or sensitive data. Such an attack does not require Dark Web perpetrators' resources, or skills. It can be commenced by anyone and such malware may spread quickly in the internal network of the targeted organization....
By: Larisa Munteanu , Mark Povey
Full Abstract and Presentation Materials:
www.blackhat.com/eu-23/briefi...