Germany’s federal data protection regulator has turned a long-running Vodafone investigation into one of the clearest telecom security warnings of the eSIM era. The BfDI imposed two GDPR fines totalling €45 million: €15 million for inadequate supervision of partner agencies and €30 million for weaknesses in customer authentication that allowed unauthorised parties to access eSIM profiles.

The decision was issued on March 10, 2025, later published by the regulator and recorded by the European Data Protection Board. Vodafone accepted and paid both fines.

Two failures, not one breach

The first part of the case came from Vodafone’s retail distribution model. External agencies sold contracts under the operator’s brand, using its systems and processing customer data on its behalf. Investigators found insufficient auditing and supervision, while malicious employees at some agencies created fictitious contracts or changed existing ones without customers’ approval. The regulator treated that as a failure under Article 28 of the GDPR, which requires companies to use and monitor processors capable of protecting personal data.

The second failure was more technically significant. Weaknesses in the combined authentication process across the MeinVodafone portal and telephone hotline enabled outsiders to retrieve customer eSIM profiles. That matters because control of a mobile profile can also mean control of calls, messages and SMS-based verification codes. ENISA has repeatedly warned that weak customer authentication and compromised operator accounts are central routes into SIM-swap fraud and wider account takeover.

The eSIM was not the problem

This case should not be read as evidence that eSIM technology is inherently less secure than a removable SIM card. The weakness was in the process used to prove who was entitled to download or recover the profile. A securely provisioned eSIM can still be undermined by an agent, hotline or web portal that accepts weak evidence of identity.

That distinction is important for operators, travel eSIM brands and enterprise connectivity platforms. The industry often presents profile delivery as the sensitive stage, yet recovery, replacement and customer support can be equally critical. A polished installation flow means little if an attacker can persuade another channel to reissue the same subscription.

READ MORE: What Comes After Provisioning? The Future of eSIM 

For travellers, the risk is especially uncomfortable. A stolen profile can disrupt connectivity while also exposing accounts that still use the mobile number for password resets or one-time codes. People relying on passkeys or authenticator apps are less dependent on the phone number, but they are not protected from the immediate loss of mobile service.

Vodafone’s response matters

The BfDI said Vodafone improved or replaced affected systems, revised how partner agencies are selected and audited, and ended relationships with partners linked to fraud. A follow-up review is intended to test whether those changes work in practice. The regulator also highlighted Vodafone’s cooperation.

“I want to emphasize that Vodafone cooperated with me continuously and without restriction throughout the entire proceedings, and also disclosed circumstances that incriminated the company itself.”

That cooperation did not erase the failures, but it appears to have been treated as a mitigating factor. BfDI President Louisa Specht-Riemenschneider’s broader message was blunt: “Investing instead of incurring risks!”

A market-wide authentication shift

Vodafone is not alone in facing the structural problem behind this case. Large operators typically combine legacy account systems, retail partners, call centres and digital self-service channels. Attackers only need the weakest route. ENISA’s SIM-swapping work has already framed poor authentication as an industry issue rather than an eSIM-specific defect.

READ MORE: Three Years In, Open Gateway Is Finally Building Something Real

The market is beginning to respond. Deutsche Telekom, O2 Telefónica and Vodafone have launched Number Verify and SIM Swap network APIs in Germany through the GSMA Open Gateway framework. These tools can help banks, marketplaces and other digital services check a number more securely or detect a recent SIM change instead of relying only on an SMS code. Passkeys, app-based authenticators and stricter risk-based recovery are also stronger alternatives for high-value accounts.

Conclusion

The €45 million penalty is large in Germany, but the more important comparison is not with record GDPR fines against global platforms. It is with the everyday security posture of other telecom operators, MVNOs and eSIM providers. The competitive gap is moving away from who can issue a profile fastest and toward who can govern identity across every channel. Vodafone’s two penalties accounted for most of the €48.1 million in GDPR fines reported across Germany during 2025, underlining how seriously regulators now view operational telecom security.

Vodafone’s remediation is meaningful, but the next test is whether customers see clearer alerts, stronger recovery checks and fewer opportunities for partner abuse. Operators that merely patch the portal while leaving call centres and resellers loosely controlled will repeat the same weakness elsewhere.

For the eSIM market, this is not an argument for slowing digital SIM adoption. It is an argument for treating profile recovery as a high-risk identity transaction. The providers most likely to earn trust will be those that make fraudulent reissue difficult, legitimate recovery quick and partner accountability visible—not those that simply make activation frictionless.