AEPD (Spain) - PS-00028-2026
Spain's AEPD fines cycling federation €4,800 for data breach affecting 261,965 individuals.
Run AEPD?
Get an email when a reviewed story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Spanish Data Protection Agency (AEPD) has fined the Spanish Cycling Federation €4,800 for a data breach that compromised the personal data of 261,965 individuals. The breach, which lasted at least two months, resulted from inadequate security measures, including insufficient access controls, lack of multi-factor authentication, and weak detection mechanisms, violating Article 5(1)(f) of the GDPR.
The lesson from this incident
Full lessonThe Spanish Cycling Federation suffered a prolonged data breach lasting at least two months, exposing the personal data of nearly 262,000 individuals due to weak access controls, absent multi-factor authentication, and inadequate detection mechanisms. The core failure was a combination of insufficient technical safeguards and a lack of timely detection, allowing the breach to persist far longer than it should have. This directly violates GDPR Article 5(1)(f), which mandates appropriate security of personal data through integrity and confidentiality controls. The case demonstrates that even smaller sports federations handling large volumes of member data must implement enterprise-grade security measures proportionate to the sensitivity and volume of data they process.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.