Spain

FEDERACIÓN ESPAÑOLA DE CICLISMO

4,800 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-14.

Rank · Sector

#86

of 361 in Individuals and Private Associations

Rank · Spain

#561

of 1,104

Rank · All fines

#1,962

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-14
Controller / Processor: FEDERACIÓN ESPAÑOLA DE CICLISMO
Sector: Individuals and Private Associations
Quoted Articles: Art. 5 (1) f) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 4,800 on FEDERACIÓN ESPAÑOLA DE CICLISMO. The credentials of a valid user were stolen and through a flaw the malicious user could read other users' records. The first anomalous activity was noticed on 24 July {year} with several others following. The AEPD was later notified of the incident. In total the affected data covered names, ID numbers, dates of birth, sex, addresses, email addresses and photos as well as other information. A total of 261,965 members were affected, including historical records, among them 14,912 minors.

Open original source Links to the regulator's original publication or another source.