The attack on the VwbP constitutes a personal data breach within the meaning of Article 33 of the General Data Protection Regulation (GDPR). 

Under Article 34 of the General Data Protection Regulation, the data subjects affected by the data theft must be informed. In addition to the public communication, the letters asking the legal entities to inform the beneficial owners of the personal data breach have been going out since Tuesday, 4 August 2026. The data protection requirements have thus been implemented.