Loading story…
Endesa (Enel Group) disclosed unauthorized access to its Energía XXI commercial platform, resulting in exposure of customer contract-related personal and financial data. Impacted data types reported include identification and contact details, Spanish national identity numbers (DNI), contract information, and payment details including IBANs; Endesa stated that account passwords were not exposed and that there was no evidence of fraudulent use at the time of notification.
Endesa reported taking containment and investigation steps including blocking access to compromised internal accounts, collecting and analyzing logs, and increasing monitoring for suspicious activity while notifying affected customers. The incident was reported to Spanish authorities including the Spanish Data Protection Agency (AEPD) and referenced coordination with national cybersecurity bodies; reporting also noted an attacker claim of large-scale SQL data theft and attempted sale on a dark web forum, though Endesa’s public statements emphasized the breach was limited to customer data access and did not involve operational disruption or ransomware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By January 15, 2026, Outpost24 published analysis assessing that the intrusion most likely involved compromised legitimate credentials rather than ransomware or operational disruption. The firm also assessed the exposed data source was consistent with Salesforce CRM and related data cloud layers accessed through elevated API or integration privileges.
After confirming the breach, Endesa blocked compromised internal accounts, began log analysis, increased monitoring, and notified affected customers. The company also reported the incident to Spain's Data Protection Agency and other relevant authorities, while stating operations were not affected and no fraudulent misuse had been confirmed.
On January 11, 2026, Endesa confirmed a security incident involving unauthorized access to its commercial platform. The company said exposed data may include customer identification and contact details, DNI numbers, contract information, and IBANs, while passwords were not compromised.
On January 4, 2026, the seller posted sample data to support claims that Endesa customer records had been stolen. Multiple reports said the samples were presented alongside offers to sell the alleged database on dark web forums.
In early January 2026, a threat actor using the aliases "glock" and "spain" began advertising an allegedly stolen Endesa database on cybercrime forums. The actor claimed the data included personal and financial information for more than 20 million people and over 1 TB of SQL database data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
outpost24.com
Open sourcescworld.com
Open sourcerescana.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spain’s **Ministry of Science, Innovation and Universities** partially shut down its “electronic headquarters,” suspending administrative procedures and disrupting citizen- and company-facing services after reporting a “technical incident” under assessment. A threat actor using the alias **GordonFreeman** claimed responsibility, posted alleged proof-of-breach samples on underground forums, and offered purportedly stolen data for sale; the samples were described as including personal records, email addresses, enrollment applications, and screenshots of official documents, with the actor alleging exploitation of a critical **IDOR** flaw to obtain valid credentials. Separately, Spain’s **Ministry of Finance (Ministerio de Hacienda y Función Pública)** faced an unverified data-breach claim from a threat actor calling themselves **HaciendaSec**, who advertised alleged access to data on **~47.3 million** citizens (including claimed tax identifiers and banking details) on a dark web forum. The Ministry, working with Spain’s **National Cryptologic Centre (CCN)**, stated it found **no evidence** of compromise or exfiltration in internal systems as of the initial investigation, and authorities are assessing whether the dataset is authentic, recycled, or sourced elsewhere; this incident is distinct from an unrelated outage at Rome’s **La Sapienza** university following a suspected ransomware attack.
Jun 29, 2026
Capital Economics and People's Energy both suffered data breaches in December 2020 that later surfaced in breach disclosures, exposing large volumes of customer information. Capital Economics, an economic research firm, had about **263,000 customer records** compromised, including names, email addresses, physical addresses, phone numbers, job titles, and employer details. People's Energy, a UK power company, had nearly **7GB of data** exposed, affecting **359,000 unique email addresses** along with names, phone numbers, physical addresses, and dates of birth. The breach also exposed staff email addresses and **`bcrypt` password hashes**, although available reporting said no customer passwords were included in the leaked data.
Jun 29, 2026
Dutch telecommunications provider **Odido** disclosed a cyberattack in which threat actors gained unauthorized access to a **customer contact/CRM system** and **downloaded personal data** associated with approximately **6.2 million customer accounts**. Odido stated the intrusion was detected over the **February 7–8** weekend and that access was terminated as quickly as possible; the company also reported the incident to the Dutch Data Protection Authority (**Autoriteit Persoonsgegevens**) and engaged external cybersecurity experts to support investigation and additional defensive measures. Odido said its **telecom operations were not disrupted**, and no threat actor group has publicly claimed responsibility; reporting also notes the attackers allegedly contacted Odido to assert they had stolen millions of records. Exposed data varies by customer but may include **full name, address/place of residence, mobile number, customer number, email address, IBAN bank account number, date of birth, and identification document details** (e.g., passport/driver’s license number and validity). Odido emphasized that **passwords** (including for the *My Odido* portal), **call logs**, **location data**, **invoice/billing details**, and **scans of ID documents** were **not** affected. Odido is notifying impacted individuals via email from **`info@mail.odido.nl`** or by SMS, and warned that the stolen data could be used for **impersonation and phishing** attempts that appear to come from Odido.
Jun 29, 2026