Spain

VODAFONE ESPAÑA, S.A.U.

400,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-17.

Rank · Sector

#73

of 383 in Media, Telecoms and Broadcasting

Rank · Spain

#48

of 1,104

Rank · All fines

#292

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-17
Controller / Processor: VODAFONE ESPAÑA, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 400,000 on VODAFONE ESPAÑA, S.A.U. On 23 May 2023 Vodafone notified the AEPD of a ransomware attack affecting their processor. The processor was responsible for the controller's customer incident management and the affected personal data included the mobile and landline phone numbers of 486,768 private customers as well as the contact information of 14,571 company representatives. While encrypted personal data such as ID numbers, names and addresses were affected in terms of availability, they were not affected in terms of confidentiality. The attacker had exploited a vulnerability known since 2 January which remained unpatched to gain access. It was found that the controller had not adequately ensured that the processor patched known vulnerabilities, nor had they carried out audits or periodic controls of the processor's security measures. The controller was also aware of earlier incidents involving the same processor.

Open original source Links to the regulator's original publication or another source.