Financial services, FinTech, banking
- Payment credited twice, unchecked amount, USSD transfer without PIN, payout without a second check.
- Indicative frameworks: PCI-DSS 4.0, BCEAO/UEMOA, DORA.
Telecom and Mobile Money
- Subscriber number, IMSI/IMEI or call records written to logs.
- Indicative frameworks: GSMA, ARTCI.
Government and public sector
- National ID, passport or tax ID in logs.
- Indicative frameworks: ANSSI/RGS, national cyber laws.
Healthcare
- Patient, diagnosis or prescription data in logs.
- Indicative frameworks: HDS, HIPAA, GDPR art. 9.
Education
- Student IDs, grades or transcripts in logs.
- Indicative frameworks: GDPR, Law 2013-450.
Energy, ports, customs, logistics
- SCADA, Modbus, PLC or meter access in logs, passive reading only.
- Indicative frameworks: NIS2, IEC 62443.
E-commerce, insurance, NGOs
- Card data, IBAN or policy numbers in logs.
- Indicative frameworks: PCI-DSS 4.0, GDPR.
Agencies and IT services
- Agency customers' credentials exposed in code or logs.
- Indicative frameworks: ISO 27001 (suppliers), GDPR art. 28.