AEPD (Spain) - PS-00020-2025
Spain's AEPD fines Alkora S.A.U. €200,000 for insufficient security after ransomware breach.
Spain's AEPD has fined Alkora S.A.U., an insurance brokerage, €200,000 following a ransomware attack that exposed the personal data of approximately 40,000 individuals, including 75 minors. The authority found that Alkora had insufficient security measures in place and failed to conduct a Data Protection Impact Assessment (DPIA) despite knowing about extreme cybercrime risks. The breach resulted in data encryption and exfiltration, affecting confidentiality, availability, and integrity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAlkora S.A.U. suffered a ransomware attack that encrypted and exfiltrated personal data belonging to approximately 40,000 individuals, including 75 minors, resulting in a €200,000 AEPD fine. The root failure was twofold: the organization lacked adequate technical and organisational security measures, and it failed to conduct a mandatory Data Protection Impact Assessment (DPIA) despite being aware of extreme cybercrime risks in its sector. Under GDPR Articles 25 and 35, organisations processing sensitive data at scale must proactively assess and mitigate privacy risks before incidents occur — not after. This case underscores that regulators will penalise both the breach itself and the failure to follow due-diligence processes that could have prevented or limited it. Insurance brokerages handling special-category or large volumes of personal data are particularly exposed if they treat DPIAs as optional.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ransomware