Holaluz-Clidom, S.A.

Summary

The Spanish DPA has imposed a fine of EUR 675,000 on Holaluz-Clidom, S.A. The controller is a major electricity retailer with over 200,000 customers. On 26 and 27 October 2022, a malicious third party used the credentials of a user account belonging to the controller's sales processor. They used this access to log in to the controller's customer service software from a foreign IP address that was not used by any of the controller's users. The third party then downloaded the personal data of a large number of data subjects. This data included tax numbers, addresses, billing information, contact details and bank details. The controller informed the supervisory authority of the breach on 28 October 2022 and provided additional information on 18 November 2022. The subsequent investigation found that the controller had mistakenly granted access to all customers' accounts to the processor's shared accounts. Furthermore, it was found that one account was shared by approximately 120 of the processor's employees. Overall, the authority concluded that the controller had not implemented adequate security measures.