Reporting credential stuffing attacks under the GDPR
The European Data Protection Board issued draft practical guidance on various types of data breaches to assist companies with identifying situations in which a data security incident may need to be reported to EU supervisory authorities and to the individuals themselves.
Source: natlawreview.com