[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcrJwtEmenclqI7g86PLqDOAjCDtR3tXHsj6gxlDtMa4":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"29cabacd-a3a7-4b99-9ea9-3ab78b24e7e7","AEPD (Spain) - PS\u002F00194\u002F2025","aepd-spain-ps-00194-2025-f24860","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS\u002F00194\u002F2025 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00194-2025.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Investigat...\" Show changes","The Spanish Data Protection Agency (AEPD) has fined Vodafone Spain €400,000 for a data breach that compromised the personal data of over 500,000 individuals. The breach occurred because Vodafone failed to address a critical vulnerability in its processor infrastructure, which was discovered months prior to the incident. The AEPD found this to be a violation of Article 32 of the GDPR, citing a lack of technical and organizational measures to safeguard data.","Spain's AEPD fines Vodafone Spain €400,000 for data breach due to unmitigated vulnerability.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00194\u002F2025&diff=53443&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-10-16T11:03:01+00:00","2026-10-16T12:00:19.240661+00:00",8,[17,20],{"name":18,"type":19},"Vodafone","vendor",{"name":21,"type":22},"processor infrastructure","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":46,"icon":25,"name":47,"slug":48},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":52,"vendors":133},[53,82,107],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":83,"name":84,"problem":85,"products":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",[87,95,99],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":83,"product_name":96,"url":97,"description":98},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":108,"name":109,"problem":110,"products":111},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":129,"product_name":130,"url":131,"description":132},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":148},"vodafone-spain-fined-400k-after-ignoring-known-vulnerability-for-months","Vodafone Spain Fined €400K After Ignoring Known Vulnerability for Months","Vodafone Spain failed to remediate a critical vulnerability in its processor infrastructure despite being aware of it months before the breach occurred, ultimately exposing the personal data of over 500,000 individuals. This is a textbook case of vulnerability management failure: knowing about a risk and not acting on it in a timely manner is legally and ethically indefensible, especially under GDPR. Article 32 of the GDPR explicitly requires organizations to implement appropriate technical and organizational measures to ensure data security, including processes for regularly testing and evaluating those measures. The €400,000 fine underscores that regulators treat inaction on known vulnerabilities as a serious compliance failure, not merely an oversight. Organizations that delay patching critical infrastructure bearing personal data face both operational and significant legal consequences.",[139,140,141,142,143,144,145,146,147],"GDPR Article 32 – Security of Processing","GDPR Article 83(4) – Administrative Fines","CIS Control 7 – Continuous Vulnerability Management","CIS Control 1 – Inventory and Control of Enterprise Assets","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-2 – Flaw Remediation","NIST Cybersecurity Framework ID.RA-1 – Asset Vulnerabilities Identified","ISO\u002FIEC 27001:2022 Annex A 8.8 – Management of Technical Vulnerabilities","ITIL 4 – Change Enablement \u002F Problem Management",{}]