Mobile phone carrier Orange has been fined in Romania by the country’s privacy watchdog for failing to protect confidential information from customers.

The issue has been discovered by a client who brought his phone in for repairs and was provided with a temporary device while service was performed.

The customer noticed that the temporary phone contained personal information of previous users, including automatic log-in for online services, details about the bank account balances, personal text messages and list of private contacts.

He proceeded to notify Orange about the data found on the temporary phone but claimed that his complaint was disregarded by the mobile carrier.

The National Supervisory Authority For Personal Data Processing (ANSPDCP) in Romania investigated the incident (Romanian) and reached the conclusion that Orange did not respect the norms for keeping confidential information safe.

As a result, the company received a slap on the wrist consisting of a 10,000 RON / €2,255 / $2,800 fine, since the temporary phone provided by the service team is the property of Orange.

The obvious risk of personal information falling into the wrong hands in this case is taking over the Facebook account, but depending on the nature of the data, the cybercrime possibilities may extend to spear phishing.