[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_sE3HIYy4TQ5dZCPTnuLomyOGgWLFP34N9NtsiX_028":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":125},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"f7073d97-6eed-4479-acc0-c6430dbe6d75","AEPD (Spain) - EXP202310345","aepd-spain-exp202310345-787288","Fixed link ← Older revision Revision as of 07:08, 16 September 2026 Line 56: Line 56: |Party_Link_3= |Party_Link_3= |Appeal_To_Body=AEPD |Appeal_To_Body=AEPD (Spain) |Appeal_To_Case_Number_Name=Expediente nº.: EXP202310345 |Appeal_To_Case_Number_Name=Expediente nº.: EXP202310345 |Appeal_To_Status=Appealed - Overturned |Appeal_To_Status=Appealed - Overturned","The Spanish Data Protection Agency (AEPD) fined DIGI Spain Telecom €140,000 for violating Article 6(1) GDPR due to ineffective security measures against SIM swap attacks. The company issued a duplicate SIM card to an unauthorized third party who impersonated the legitimate line holder, leading to identity theft. The AEPD found that DIGI Spain failed to demonstrate compliance with its duty of care, especially given the documented risk of SIM swap attacks and the scale of processing.","Spain's AEPD fines DIGI Spain Telecom €140,000 for ineffective security measures against SIM swap attacks.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_EXP202310345&diff=53059&oldid=52199","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-16T07:08:37+00:00","2026-09-16T08:00:14.726099+00:00",8,[17],{"name":18,"type":19},"DIGI Spain Telecom","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[44],{"type":45,"value":46,"context":47},"malware","SIM swap attacks","Attack vector leading to identity theft and unauthorized SIM card issuance.",[18],{"controls":50,"vendors":124},[51,80,101],{"slug":52,"name":53,"problem":54,"products":55},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[85,93],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":102,"name":103,"problem":104,"products":105},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[106,111,117],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":107,"product_name":108,"url":109,"description":110},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":112,"product_name":113,"url":115,"description":116},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":121,"url":122,"description":123},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":126,"title":127,"body":128,"framework_refs":129,"framework_notes":144},"sim-swap-fraud-exposes-weak-identity-verification-at-digi-spain-telecom","SIM Swap Fraud Exposes Weak Identity Verification at DIGI Spain Telecom","DIGI Spain Telecom failed to implement adequate identity verification controls before issuing a duplicate SIM card, allowing an unauthorized third party to impersonate a legitimate customer and commit identity theft. The root cause was insufficient access control around a sensitive, high-risk process — SIM swapping — despite the telecommunications industry being well aware of this attack vector. This failure directly violated GDPR Article 6(1) by processing personal data (and enabling access to the victim's accounts) without a lawful basis. The €140,000 fine underscores that regulators expect organisations to implement proportionate safeguards for known, documented risks, and that ignorance of industry-wide threats is not a credible defence.",[130,131,132,133,134,135,136,137,138,139,140,141,142,143],"GDPR Article 5(1)(f) — Integrity and confidentiality","GDPR Article 6(1) — Lawfulness of processing","GDPR Article 24 — Responsibility of the controller","GDPR Article 25 — Data protection by design and by default","GDPR Article 32 — Security of processing","GDPR Article 33\u002F34 — Breach notification","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","NIST SP 800-63-3 — Digital Identity Guidelines (IAL\u002FAAL levels)","NIST AC-2 — Account Management","NIST AC-17 — Remote Access controls","CIS Control 6 — Access Control Management","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 — A.5.17 Authentication information","ITIL 4 — Risk Management and Service Design practices",{}]