AEPD (Spain) - EXP202310345
Spain's AEPD fines DIGI Spain Telecom €140,000 for ineffective security measures against SIM swap attacks.
The Spanish Data Protection Agency (AEPD) fined DIGI Spain Telecom €140,000 for violating Article 6(1) GDPR due to ineffective security measures against SIM swap attacks. The company issued a duplicate SIM card to an unauthorized third party who impersonated the legitimate line holder, leading to identity theft. The AEPD found that DIGI Spain failed to demonstrate compliance with its duty of care, especially given the documented risk of SIM swap attacks and the scale of processing.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DIGI Spain Telecom?
Get an email when a new story names DIGI Spain Telecom, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDIGI Spain Telecom failed to implement adequate identity verification controls before issuing a duplicate SIM card, allowing an unauthorized third party to impersonate a legitimate customer and commit identity theft. The root cause was insufficient access control around a sensitive, high-risk process — SIM swapping — despite the telecommunications industry being well aware of this attack vector. This failure directly violated GDPR Article 6(1) by processing personal data (and enabling access to the victim's accounts) without a lawful basis. The €140,000 fine underscores that regulators expect organisations to implement proportionate safeguards for known, documented risks, and that ignorance of industry-wide threats is not a credible defence.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SIM swap attacks