At the beginning of January, Endesa announced that it had been the victim of a cyberattack that compromised its customers’ personal data, including identification details, identity documents and banking information.
At first glance, this type of attack may appear to be an isolated incident, but the reality is quite different. In a recently published report , the Spanish Data Protection Agency (AEPD) stated that during 2025 it received 2,765 notifications of personal data breaches. It should also be remembered that, during 2024, the Agency had already fined Endesa for infringing five provisions of the GDPR.
The message is clear: it highlights the value of personal data as a target for cybercriminals. Data theft is becoming increasingly common, with the intention of subsequently selling the information on illegal markets and using it for extortion purposes.
Therefore, complying with applicable data protection regulations goes far beyond a legal obligation. It is an essential task for any organisation, whether large or small. Security breaches do not discriminate, and neither do their legal consequences.
What are the legal obligations of an affected organisation?
Following a security breach, the responsible entity is required to contain it by preventively blocking compromised accounts and assessing the risk posed to the rights and freedoms of affected customers, while adopting the necessary corrective measures.
Furthermore, Article 33 of the General Data Protection Regulation (GDPR) establishes the obligation to notify the competent supervisory authority, the AEPD in Spain, within a maximum period of 72 hours. This obligation stems from the accountability principle applicable to data controllers. It is important to note that timely and proper notification is evidence of an organisation’s diligence. Some of the breaches notified to the AEPD were subsequently investigated further due to indications of a lack of such diligence on the part of the affected organisation.
At the same time as notifying the competent authority, affected individuals must also be informed whenever there is a significant risk, through personalised communications (as Endesa did by sending mass notifications to customers). In its report, the AEPD indicated that more than 200 million high-risk notifications were issued. Communication is a key element of accountability, and its absence may trigger an investigation by the AEPD.
Finally, and equally important, the company that has suffered the attack must adopt corrective measures to prevent this type of incident from occurring again.
Risks
The risks associated with a cyberattack go far beyond service disruption, as they may result in financial penalties for non-compliance with the GDPR and serious reputational damage. Poor management of the situation may lead to the loss of trust of thousands of customers and damage to the company’s brand image.
Affected individuals may face serious consequences such as identity theft, financial fraud, or the disclosure and misuse of sensitive information.
According to the AEPD, the breaches affecting the highest number of individuals were those related to ransomware attacks or intrusions into information systems. However, other common breaches were linked to “human error”, such as sending data to the wrong recipients or inadvertently disclosing personal information.
This raises the question: could it happen to any company? We have already seen that the answer is yes. Regardless of size, it is a problem that can affect SMEs and medium-sized businesses alike. The causes include inadequate protocols, lack of employee training and shortcomings in implemented security measures.
What to do if you are an affected customer
First, check whether you have received a notification from Endesa confirming that your information may have been affected. Then review the transactions on the bank account linked to the company and report any unauthorised charges.
Under no circumstances should suspicious links related to the incident be opened; it is always preferable to access information through the official website. Finally, it may be advisable to change the associated password, especially if it is also used for other services or accounts.
Conclusion
As we can see, prevention and incident management are essential. Cybersecurity and data protection must go hand in hand, meaning that adequate protection requires a comprehensive approach combining risk analysis, technical and organisational measures, response protocols and continuous review for improvement.
Data protection is neither optional nor a mere administrative formality. It is a legal responsibility and a market requirement. Investing in prevention, professional advice and proper risk management reduces the likelihood of penalties, strengthens customer confidence and enhances a company’s credibility and reputation.
Article by Alba Gómez.
Published in Law&Trends
