AEPD (Spain) - PS/00194/2025
Spain's AEPD fines Vodafone Spain €400,000 for data breach due to unmitigated vulnerability.
Run Vodafone?
Get an email when a reviewed story names Vodafone, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Spanish Data Protection Agency (AEPD) has fined Vodafone Spain €400,000 for a data breach that compromised the personal data of over 500,000 individuals. The breach occurred because Vodafone failed to address a critical vulnerability in its processor infrastructure, which was discovered months prior to the incident. The AEPD found this to be a violation of Article 32 of the GDPR, citing a lack of technical and organizational measures to safeguard data.
The lesson from this incident
Full lessonVodafone Spain failed to remediate a critical vulnerability in its processor infrastructure despite being aware of it months before the breach occurred, ultimately exposing the personal data of over 500,000 individuals. This is a textbook case of vulnerability management failure: knowing about a risk and not acting on it in a timely manner is legally and ethically indefensible, especially under GDPR. Article 32 of the GDPR explicitly requires organizations to implement appropriate technical and organizational measures to ensure data security, including processes for regularly testing and evaluating those measures. The €400,000 fine underscores that regulators treat inaction on known vulnerabilities as a serious compliance failure, not merely an oversight. Organizations that delay patching critical infrastructure bearing personal data face both operational and significant legal consequences.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.