2024 Vendor breach — 850k+ Spanish customers

2024 850.0K records affected

Data compromised

Names, DNI, contact information

Technical writeup

Breach May 5–7 via external vendor vulnerability. ~1.5GB data: full names, DNI, contact info. 600k free-market + 250k regulated-market accounts. Data listed on dark web within 24 hours. No financial or password data. AEPD investigation.

Root cause

External vendor vulnerability

References

https://hoploninfosec.com/iberdrola-group-data-breach
https://www.dawndigest.com/news/iberdrola-suffers-cyber-attack-exposing-data-of-over-650-000-customers-in-spain