AEPD (Spain) - EXP202406239

Iberdrola Clientes failed to implement sufficiently strong authentication controls for customer identity verification over the phone, relying solely on static, easily obtainable data that could be exploited by unauthorized parties to alter sensitive contact details. This represents a fundamental failure in access control design, where knowledge-based authentication (KBA) using predictable or publicly accessible information provided no meaningful security barrier. The breach exposed customers to risks including account takeover, fraud, and privacy violations — all preventable with stronger multi-factor or dynamic verification methods. Under GDPR Article 25 (Data Protection by Design and by Default) and Article 32 (Security of Processing), organizations are legally obligated to implement appropriate technical and organizational measures, and failure to do so can result in substantial regulatory penalties as demonstrated by this €1,000,000 fine.