Spain

VODAFONE ESPAÑA, S.A.U.

500,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-11.

Rank · Sector

#70

of 383 in Media, Telecoms and Broadcasting

Rank · Spain

#45

of 1,104

Rank · All fines

#261

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-11
Controller / Processor: VODAFONE ESPAÑA, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 500,000 on VODAFONE ESPAÑA, S.A.U. On November 1st 2023 a ransomeware attack on one of Vodafones processors, the processor mainteined one of its customer platfforms. The attcker geined access to the server through a shared maintanenance account, that could be accessed through a VPN, only requiring a weak password. The attacker installed ransomware, encrapting the personal data stored and making it unavailable, though there was no evidence of exfiltration. In a contract with the processor only inadequate measures to ensure security were mandated, the controller furthermore did not audit the processor.

Open original source Links to the regulator's original publication or another source.