[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2OK0HTNmf0GXMVMy0oalDOJEASKnTBHDHMWwCzZ1f1Y":3},{"article":4,"iocs":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"b517be1b-90be-4959-b69b-d1cd403622d4","Threat Actor Claims to Sell a 110 GB Iberdrola Customer Database Affecting 7 Million Customers","threat-actor-claims-to-sell-a-110-gb-iberdrola-customer-database-affecting-7-mil-fabee0","A threat actor using the alias spain claims to be selling a 109.79 GB customer database stolen from Iberdrola, one of the world's largest electricity utilities, and lists the domain iberdrola.es.","A threat actor using the alias 'spain' claims to be selling a 109.79 GB database allegedly stolen from Iberdrola, Spain's largest electricity utility, containing records of approximately 7 million customers. The purported dataset includes sensitive personally identifiable information such as customer names, IBANs, national IDs (DNI\u002FNIF\u002FCIF), email addresses, phone numbers, addresses, tariff details, billing information, and customer photos. The claim remains unverified and has not been publicly acknowledged by Iberdrola, though the dataset's breadth and specificity pose significant risks for financial fraud, phishing, and identity theft if genuine.","Threat actor claims to sell 110 GB Iberdrola customer database affecting 7M Spanish customers.","Data7M customers \u002F 110 GB PriceTelegram sale CountrySpain Actorspain ▣Post details TargetIberdrola (iberdrola.es) CountrySpain SectorEnergy \u002F Electric Utility ClaimCustomer database offered for sale Data~7M customer records, 109.79 GB ObservedJun 1, 2026 PriceTelegram sale Actorspain (claims hacked by \"RP\") !Allegedly exposed 7M+ customer records (claimed) Customer names & account IDs IBAN bank account numbers National IDs (DNI \u002F NIF \u002F CIF) Email addresses & phone numbers Addresses (city, province, ZIP) Tariff, contract & power (potencia) data Billing & purchase totals Supply-point identifiers (CUPS) Customer photos & call records ␱Screenshot Screenshot 1 Redacted preview ⚠Potential impact If genuine, a dataset of 7 million customers containing IBAN bank details, national IDs (DNI\u002FNIF\u002FCIF), emails, phone numbers, and addresses would be highly valuable for financial fraud, phishing, and identity theft at scale across Spain. Energy-account and supply-point details could also enable convincing, targeted scams against utility customers. As with any large \"for sale\" listing, the figures may be inflated or partly recycled from earlier breaches. iStatus Unverified A sample and a full column listing were posted to an underground forum, with the full dataset offered via a Telegram contact and escrow; the sample links, password, and contact identifiers are not reproduced here. The claim has not been independently confirmed and Iberdrola has not publicly addressed it. Want the non-redacted screenshots? Paid subscribers get all of the claim details and unredacted screenshots, check out the threat feed or ransomware feed. View pricing → DARK WEB INFORMER - THREAT INTELLIGENCE","https:\u002F\u002Fdarkwebinformer.com\u002Fthreat-actor-claims-to-sell-a-110-gb-iberdrola-customer-database-affecting-7-million-customers\u002F","https:\u002F\u002Fstorage.ghost.io\u002Fc\u002F6b\u002F16\u002F6b16ac9c-cd67-432f-b0f3-bbec941084ff\u002Fcontent\u002Fimages\u002F2026\u002F06\u002F2397586238975698723649876325498722.png","2026-06-02T15:32:26+00:00","2026-06-02T16:00:08.573+00:00",8,[18,21],{"name":19,"type":20},"Iberdrola","vendor",{"name":22,"type":23},"spain","threat_actor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":24,"icon":26,"name":27,"slug":28},null,"Breaches","breaches",[30,35,40],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"domain","iberdrola.es","Victim domain listed in breach claim"]