First of all I would like to state that my question occurs in a context of EU laws and EU citizen.

I found a vulnerability in a product distributed in a few companies of EU countries. This vulnerability allows an attacker with a foothold in the network to gather encrypted, unauthorized backups of critical personal data. There is a few concerns on this vulnerability as :

  • It is easy to avoid, and it is easy to fix (but has been running for years)
  • It allows the attacker to get the data from ALL the consumers of the product, not only the one that has been compromised (= can get the client database of each consumer of the product by just compromising one consumer)
  • Due to other events, we were told by the software vendor that he did not own any backup of his consumer data, nor provides the capacity to do so (which is wrong because I found weekly backups of critical personal data on their server)

As the software vendor is not known to be very open to discussing topics such as bugs & vulnerabilities, and tells us he has not undocumented backup system, what would be the best approach to discuss this critical vulnerability ? Should we get in touch with the national GDPR referent ?

Is it legal to "make pressure" on the vendor by stating that the vulnerability will be sold/published if he does not act appropriately ?

Thanks for your time.

  • Please expand "RGPD" at least once in the question. What is meant by "he has not undocumented backup system" May 9 at 16:00
  • RGPD is Règlement Général sur la Protection des Données - aka GDPR
    – Rock Ape
    May 9 at 16:40
  • Exactly sorry for using the French version of the name. It indeed means GDPR. I will edit in the post for more clarity. >What is meant by "he has not undocumented backup system" --> The vendor actually maintains unencrypted backups of all the clients of its consumers, despite telling otherwise
    – MedAl
    May 9 at 17:25
  • 4
    You need a real lawyer. This is a serious business and not something for which you want to rely on information from random people on a random website. And requests for specific legal advice are outside the scope of Law.SE. May 9 at 18:41
  • @NateEldredge Thanks. I understand the nature of the topic and its criticality. Before getting in the process of hiring a lawyer, I just wanted to get some insights from community members that could have possibly dealt with similar issues.
    – MedAl
    May 10 at 9:10

Tread carefully

Reading your question, it appears that you have accessed their system without permission. That is, legally, you’re a hacker and a criminal.

If you draw this to their attention, there are two possibilities:

  1. The middle level manager responsible will admit to their boss that they screwed up, losing their bonus, damaging their career and possibly getting fired, or
  2. They will insist that they did nothing wrong, report you to the police and have your ass thrown in jail.

Which do you think is more likely?

  • Hi Dale, thanks for answering. But this is not exactly the kind of answer I was expecting :) The good old "muh hacker" time is over from a very long time. I was searching for a solution in which the vendor is actually forced to provide a fix and keep all the clients data safe.
    – MedAl
    May 10 at 9:12
  • @MedAl sorry, the law deals with this world, not Utopia. Even where the law ostensibly protects whistleblowers, they often suffer adverse consequences which, while they might not be strictly legal, are very real.
    – Dale M
    May 10 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.