[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fazp9dtQi7LneaQPVoIymLxUiE4tlgViRY5xiKEIQYFI":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":111},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"06384558-4b36-4cfa-8e94-9069e1fa371e","🚨🇪🇸 A threat actor known as gang, posting under the alias RP, is distributing a dataset allege...","a-threat-actor-known-as-gang-posting-under-the-alias-rp-is-distributing-a-datase-e0a8af","🚨🇪🇸 A threat actor known as gang, posting under the alias RP, is distributing a dataset allegedly tied to Iberdrola, one of Spain's largest energy and electricity utility companies.\n\nThe actor claims around 300,000 customer records have been released as a \"first phase,\" https:\u002F\u002Ft.co\u002FHwjuw3dQqK","A threat actor operating under the alias 'RP' from a group known as 'gang' has claimed to distribute a dataset containing approximately 300,000 customer records allegedly stolen from Iberdrola, one of Spain's largest energy and electricity utility companies. The actor describes this as a 'first phase' release, suggesting additional data may follow. The breach potentially affects a critical infrastructure operator providing essential services to millions of Spanish consumers.","Threat actor 'RP' claims to release 300K customer records from Spain's Iberdrola utility company.","https:\u002F\u002Fx.com\u002FDarkWebInformer\u002Fstatus\u002F2063065024189399321","https:\u002F\u002Fpbs.twimg.com\u002Fmedia\u002FHKF6qkmXAAAJ8AK.jpg","2026-06-06T01:06:46+00:00","2026-06-06T02:00:08.266069+00:00",7,[17,20],{"name":18,"type":19},"RP (gang)","threat_actor",{"name":21,"type":22},"Iberdrola","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"malware","Iberdrola dataset leak","Alleged 300K customer records from Spanish utility company",[21],{"controls":51,"vendors":110},[52,81],{"slug":53,"name":54,"problem":55,"products":56},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"slug":82,"name":83,"problem":84,"products":85},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":112,"title":113,"body":114,"framework_refs":115,"framework_notes":123},"critical-infrastructure-data-breach-exposes-300k-customer-records","Critical Infrastructure Data Breach Exposes 300K Customer Records","A threat actor has allegedly stolen and released 300,000 customer records from Iberdrola, a major Spanish energy utility company, marking this as only the 'first phase' of data disclosure. This breach demonstrates the high-value target that critical infrastructure companies represent to cybercriminals, who can leverage stolen customer data for financial gain or further attacks. The incident highlights the cascading risks when essential service providers fail to adequately protect sensitive customer information. Critical infrastructure breaches not only compromise individual privacy but can potentially disrupt essential services that millions depend on daily.",[116,117,118,119,120,121,122],"CIS Control 3","CIS Control 13","NIST PR.DS-1","NIST DE.CM-1","GDPR Article 32","GDPR Article 33","NIS2 Directive",{"NIST DE.CM-1":124,"NIST PR.DS-1":125,"CIS Control 3":126,"CIS Control 13":127,"NIS2 Directive":128,"GDPR Article 32":129,"GDPR Article 33":130},"Network monitoring helps identify unusual outbound transfers indicating a breach in progress.","Protecting customer data at rest reduces the harm if databases are stolen.","Data protection controls such as encryption and access restrictions would limit what attackers could take from Iberdrola's customer data.","Network monitoring helps detect the exfiltration of 300,000 records before the data is published.","NIS2 requires energy operators to manage cyber risks and report significant incidents, which applies to Iberdrola as an essential entity.","Securing customer personal data is required by Article 32, especially for large utilities.","The theft of 300,000 customer records must be reported to the authority within 72 hours."]