{"id":35336,"date":"2025-09-30T10:52:56","date_gmt":"2025-09-30T10:52:56","guid":{"rendered":"https:\/\/www.pkf-attest.es\/noticias\/sancion-brecha-datos-2\/"},"modified":"2025-09-30T10:52:56","modified_gmt":"2025-09-30T10:52:56","slug":"sancion-brecha-datos-2","status":"publish","type":"noticias","link":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/","title":{"rendered":"AEPD sanction to telecommunications company for data breach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\"><strong>18,000 fine after ransomware attack affecting employees and former employees<\/strong><\/p>\n\n\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-text-color has-link-color wp-elements-1\" id=\"h-que-ocurrio-en-la-brecha-de-seguridad\" style=\"color:#0f3780;font-size:24px\">What happened in the security breach?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">The <strong>Spanish Data Protection Agency<\/strong> has <strong>fined <\/strong>a company in the <strong>telecommunications <\/strong>sector 18,000 euros following a serious security breach that compromised personal data of employees and former employees of different companies linked to its activity. The incident, which occurred in September 2023, followed a <strong>ransomware <\/strong>attack that encrypted corporate systems and allowed the exfiltration of sensitive information.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-text-color has-link-color wp-elements-2\" id=\"h-responsabilidad-de-la-empresa-y-relacion-con-otras-sociedades\" style=\"color:#0f3780;font-size:20px\">Liability of the company and relationship with other companies<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">Initially, the <strong>AEPD <\/strong>was informed that it was a business group made up of several companies. However, the main company subsequently rectified this description, specifying that there was in fact a <strong>contract for the provision of services<\/strong> between itself and the rest of the affected entities. This circumstance played an important role in the assessment of liability in the case, since it determined that the sanctioned company acted both as a <strong>controller <\/strong>in relation to its own employees and as <strong>a <\/strong>data processor in relation to the employees of the other companies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-text-color has-link-color wp-elements-3\" id=\"h-datos-comprometidos-y-fallos-graves-de-seguridad\" style=\"color:#0f3780;font-size:20px\">Compromised data and serious security breaches<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">The <strong>compromised data<\/strong> included first name, last name, address, telephone number, email address, ID card number and even, in some cases, financial information contained in payrolls. The investigation revealed<strong>serious weaknesses<\/strong> in system security: a generic VPN user with outdated credentials was active, there were no limits on authentication attempts, the domain controller was running on obsolete equipment and there were no strong authentication mechanisms for remote access. These shortcomings facilitated the intrusion and revealed the <strong>lack of<\/strong> adequate <strong>technical and organizational measures<\/strong> to protect personal data from unauthorized access.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-text-color has-link-color wp-elements-4\" id=\"h-infraccion-del-rgpd-y-sancion-aplicada\" style=\"color:#0f3780;font-size:20px\">Infringement of the GDPR and applied penalty<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">The Agency concluded that the <strong>principle of integrity and confidentiality<\/strong> set out in Article <strong>5.1.f of the GDPR<\/strong> had been violated, both in the processing carried out as the data controller and in those in which the company acted as the processor. The initial <strong>penalty <\/strong>amounted to 30,000 euros, but the amount was reduced to 18,000 euros when liability was recognized and voluntary payment was made in advance.<\/p>\n\n\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-text-color has-link-color wp-elements-5\" id=\"h-lecciones-para-garantizar-la-proteccion-de-datos-personales\" style=\"color:#0f3780;font-size:24px\">Lessons to ensure the protection of personal data<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">The <strong>resolution <\/strong>reflects that it is not enough to have processing contracts or security clauses on paper; it is essential to <strong>ensure <\/strong>that the <strong>measures committed to <\/strong>are actually and effectively implemented. Information protection requires investments in up-to-date systems, robust access controls and incident response plans, as well as an organizational culture in which the <strong>security <\/strong>of personal data is part of the <strong>corporate strategy<\/strong>.<\/p>\n","protected":false},"featured_media":19553,"template":"novedad-corporativa-single-post.php","categories":[],"tags":[214,212],"novedades_corporativa":[],"class_list":["post-35336","noticias","type-noticias","status-publish","has-post-thumbnail","tag-gdpr","tag-news","entry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.5 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>AEPD sanction | Data Breach<\/title>\n<meta name=\"description\" content=\"The AEPD fines a telecommunications company \u20ac18,000 after a ransomware attack that compromised personal data.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AEPD sanction to telecommunications company for data breach\" \/>\n<meta property=\"og:description\" content=\"The AEPD fines a telecommunications company \u20ac18,000 after a ransomware attack that compromised personal data.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/\" \/>\n<meta property=\"og:site_name\" content=\"PKF Attest\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/09\/sancion_aepd_datos_rgpd-min.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1380\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/\",\"name\":\"AEPD sanction | Data Breach\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/sancion_aepd_datos_rgpd-min.png\",\"datePublished\":\"2025-09-30T10:52:56+00:00\",\"description\":\"The AEPD fines a telecommunications company \u20ac18,000 after a ransomware attack that compromised personal data.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/sancion_aepd_datos_rgpd-min.png\",\"contentUrl\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/sancion_aepd_datos_rgpd-min.png\",\"width\":2560,\"height\":1380},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/noticias\\\/sancion-brecha-datos-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AEPD sanction to telecommunications company for data breach\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/\",\"name\":\"PKF Attest\",\"description\":\"PKF Attest\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#organization\",\"name\":\"PKF-Attest\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/Logotipo_PKF-Attest-675x675-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.pkf-attest.es\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/Logotipo_PKF-Attest-675x675-1.jpg\",\"width\":675,\"height\":675,\"caption\":\"PKF-Attest\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pkf-attest.es\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/1078028\\\/admin\\\/dashboard\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"AEPD sanction | Data Breach","description":"The AEPD fines a telecommunications company \u20ac18,000 after a ransomware attack that compromised personal data.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/","og_locale":"en_US","og_type":"article","og_title":"AEPD sanction to telecommunications company for data breach","og_description":"The AEPD fines a telecommunications company \u20ac18,000 after a ransomware attack that compromised personal data.","og_url":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/","og_site_name":"PKF Attest","og_image":[{"width":2560,"height":1380,"url":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/09\/sancion_aepd_datos_rgpd-min.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/","url":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/","name":"AEPD sanction | Data Breach","isPartOf":{"@id":"https:\/\/www.pkf-attest.es\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/#primaryimage"},"image":{"@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/09\/sancion_aepd_datos_rgpd-min.png","datePublished":"2025-09-30T10:52:56+00:00","description":"The AEPD fines a telecommunications company \u20ac18,000 after a ransomware attack that compromised personal data.","breadcrumb":{"@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/#primaryimage","url":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/09\/sancion_aepd_datos_rgpd-min.png","contentUrl":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2025\/09\/sancion_aepd_datos_rgpd-min.png","width":2560,"height":1380},{"@type":"BreadcrumbList","@id":"https:\/\/www.pkf-attest.es\/en\/noticias\/sancion-brecha-datos-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pkf-attest.es\/en\/"},{"@type":"ListItem","position":2,"name":"AEPD sanction to telecommunications company for data breach"}]},{"@type":"WebSite","@id":"https:\/\/www.pkf-attest.es\/en\/#website","url":"https:\/\/www.pkf-attest.es\/en\/","name":"PKF Attest","description":"PKF Attest","publisher":{"@id":"https:\/\/www.pkf-attest.es\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pkf-attest.es\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.pkf-attest.es\/en\/#organization","name":"PKF-Attest","url":"https:\/\/www.pkf-attest.es\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pkf-attest.es\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2023\/12\/Logotipo_PKF-Attest-675x675-1.jpg","contentUrl":"https:\/\/www.pkf-attest.es\/wp-content\/uploads\/2023\/12\/Logotipo_PKF-Attest-675x675-1.jpg","width":675,"height":675,"caption":"PKF-Attest"},"image":{"@id":"https:\/\/www.pkf-attest.es\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/1078028\/admin\/dashboard\/"]}]}},"_links":{"self":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/noticias\/35336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/noticias"}],"about":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/types\/noticias"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/media\/19553"}],"wp:attachment":[{"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/media?parent=35336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/categories?post=35336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/tags?post=35336"},{"taxonomy":"novedades_corporativa","embeddable":true,"href":"https:\/\/www.pkf-attest.es\/en\/wp-json\/wp\/v2\/novedades_corporativa?post=35336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}