Possibly, yes. The European Data Protection Board (EDPB) has issued draft practical guidance on various types of data breaches to assist companies with identifying situations in which a data security incident may need to be reported to EU supervisory authorities (the government regulator for privacy in various EU member countries).

The EDPB addresses a common scenario in which an employee falls victim to social engineering and gives up his or her log-in credentials, enabling a threat actor access to their email account. The EDPB’s examples focus on the threat actor’s desire to intercept a payment transaction to divert funds for financial gain but notes that, in the process, personal data may be exposed. That confidentiality breach of personal information could require notification even though the threat actor’s target likely was not the personal data itself but instead money.

In the EDPB’s example, the threat actor sets up an auto-forwarding rule (a common tactic in such compromises whereby the threat actor has all incoming email forwarded to his personal email account, thus guaranteeing he will continue to receive the target’s emails even if the target changes the account password), which results in name and wage information relating to certain employees being auto-forwarded. The EDPB opines that such a risk would give rise to notification requirements to both the supervisory authority and the data subjects.

However, the EDPB does not address whether a full review of the contents of the mailbox would be required, instead focusing only on the content of what was auto-forwarded.