[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fye9Tt4zIyZls_tNgoiPMXq12JJPbEkTYmmxx0SMK2ts":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":78},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"dfad7e86-82a2-402b-91e3-b2885b7b9e59","AEPD (Spain) - EXP202406239","aepd-spain-exp202406239-1ae5da","Show changes","Spain's Data Protection Agency (AEPD) has upheld a €1,000,000 fine against Iberdrola Clientes, S.A.U. for violating GDPR. The energy supplier failed to implement adequate security measures for customer identity verification via phone, allowing unauthorized changes to contact details using easily accessible static data.","Spain's AEPD fines Iberdrola Clientes €1M for inadequate customer identity verification.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_EXP202406239&diff=52120&oldid=50902","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-07-08T11:12:31+00:00","2026-07-08T12:00:33.27415+00:00",7,[17,20],{"name":18,"type":19},"Iberdrola","vendor",{"name":21,"type":22},"Iberdrola Clientes, S.A.U.","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":77},[48],{"slug":49,"name":50,"problem":51,"products":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",[],{"slug":79,"title":80,"body":81,"framework_refs":82,"framework_notes":93},"iberdrola-fined-1m-for-weak-phone-based-identity-verification-allowing-unauthorized-account-changes","Iberdrola Fined €1M for Weak Phone-Based Identity Verification Allowing Unauthorized Account Changes","Iberdrola Clientes failed to implement sufficiently strong authentication controls for customer identity verification over the phone, relying solely on static, easily obtainable data that could be exploited by unauthorized parties to alter sensitive contact details. This represents a fundamental failure in access control design, where knowledge-based authentication (KBA) using predictable or publicly accessible information provided no meaningful security barrier. The breach exposed customers to risks including account takeover, fraud, and privacy violations — all preventable with stronger multi-factor or dynamic verification methods. Under GDPR Article 25 (Data Protection by Design and by Default) and Article 32 (Security of Processing), organizations are legally obligated to implement appropriate technical and organizational measures, and failure to do so can result in substantial regulatory penalties as demonstrated by this €1,000,000 fine.",[83,84,85,86,87,88,89,90,91,92],"GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 32 – Security of Processing","NIST SP 800-63B – Digital Identity Guidelines (Authentication)","NIST AC-2 – Account Management","NIST IA-5 – Authenticator Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","ISO\u002FIEC 27001:2022 – A.8.5 Secure Authentication","ITIL 4 – Information Security Management Practice",{}]