# Art. 33(5) Breach Register — Annual Summary Report

## Report Metadata

| Field | Value |
|-------|-------|
| Reporting Period | 1 January 2025 — 31 December 2025 |
| Report Date | 15 January 2026 |
| Prepared By | Dr. Elena Vasquez, Data Protection Officer |
| Presented To | Board Audit Committee, Stellar Payments Group |

## Executive Summary

During 2025, Stellar Payments Group recorded 14 personal data breaches in the Art. 33(5) breach register. Of these, 5 required supervisory authority notification under Art. 33(1) and 2 required data subject notification under Art. 34(1). The total number of affected data subjects across all breaches was 18,947. All remediation actions for closed breaches have been completed. Two breaches from Q4 2025 have ongoing remediation with target completion in Q1 2026.

## Breach Statistics

### Total Breaches by Quarter

| Quarter | Breaches | SA Notified | DS Notified | Data Subjects Affected |
|---------|----------|-------------|-------------|----------------------|
| Q1 2025 | 2 | 0 | 0 | 12 |
| Q2 2025 | 5 | 2 | 1 | 4,235 |
| Q3 2025 | 3 | 1 | 0 | 890 |
| Q4 2025 | 4 | 2 | 1 | 13,810 |
| **Total** | **14** | **5** | **2** | **18,947** |

### Breach Type Distribution

| Type | Count | Percentage |
|------|-------|-----------|
| Confidentiality | 9 | 64.3% |
| Availability | 3 | 21.4% |
| Integrity | 1 | 7.1% |
| Combined (Confidentiality + Availability) | 1 | 7.1% |

### Root Cause Categories

| Root Cause | Count | Percentage |
|-----------|-------|-----------|
| Human error (misdirected communications) | 5 | 35.7% |
| External attack (phishing/malware) | 3 | 21.4% |
| Insider threat (unauthorized access) | 2 | 14.3% |
| Technical failure (system misconfiguration) | 2 | 14.3% |
| Third-party/processor incident | 1 | 7.1% |
| Lost device | 1 | 7.1% |

### Risk Level Distribution

| Risk Level | Count | SA Notification Rate |
|-----------|-------|---------------------|
| Unlikely to result in risk (score 6-8) | 7 | 0% |
| Likely to result in risk (score 9-12) | 4 | 75% (3 of 4) |
| Approaching high risk (score 13-18) | 2 | 100% |
| Likely to result in high risk (score 19-24) | 1 | 100% |

## Notification Performance

| Metric | Value | Target | Status |
|--------|-------|--------|--------|
| Mean time from awareness to SA notification | 48.3 hours | Under 72 hours | Met |
| Mean time from risk assessment to DS notification | 5.2 days | Under 7 days | Met |
| SA notifications within 72-hour deadline | 5 of 5 (100%) | 100% | Met |
| DS notifications within 7-day target | 2 of 2 (100%) | 100% | Met |

## Remediation Status

| Status | Count |
|--------|-------|
| All remediation actions completed | 12 |
| Remediation in progress (within target) | 2 |
| Remediation overdue | 0 |

## Recommendations

1. **Address human error root cause**: 35.7% of breaches resulted from misdirected communications. Recommend deploying email DLP recipient verification prompts and expanding secure file transfer platform usage.
2. **Strengthen external attack defenses**: Deploy phishing-resistant MFA (FIDO2/WebAuthn) for all accounts accessing personal data systems (currently deployed only for privileged accounts).
3. **Improve insider threat detection**: Expand UEBA coverage to include the analytics data warehouse and mobile app backend (gaps identified in the Q4 2025 detection assessment).
4. **Register improvement**: Add a field for "time to detect" (breach timestamp to discovery timestamp) to enable dwell time trend analysis.
5. **Board reporting cadence**: Continue quarterly breach summary to the Audit Committee with full annual report.