[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYY7geceI9RgtpjNIqlopblYHroBtjyTY4rulXXANUwg":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"207e4af2-ef43-4048-acc3-9e699c0bfc39","AEPD (Spain) - PS-00020-2025","aepd-spain-ps-00020-2025-b38a0d","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS-00020-2025 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00026-2025.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Cod...\" Show changes","Spain's AEPD has fined Alkora S.A.U., an insurance brokerage, €200,000 following a ransomware attack that exposed the personal data of approximately 40,000 individuals, including 75 minors. The authority found that Alkora had insufficient security measures in place and failed to conduct a Data Protection Impact Assessment (DPIA) despite knowing about extreme cybercrime risks. The breach resulted in data encryption and exfiltration, affecting confidentiality, availability, and integrity.","Spain's AEPD fines Alkora S.A.U. €200,000 for insufficient security after ransomware breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00020-2025&diff=52050&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-07-03T10:20:49+00:00","2026-07-03T12:00:19.318363+00:00",8,[17,20],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"Alkora S.A.U.","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[47],{"type":48,"value":43,"context":49},"malware","Attack type used in the breach",[18,21],{"controls":52,"vendors":137},[53,82,108],{"slug":54,"name":55,"problem":56,"products":57},"patch-management","Automated patch management","Known holes get closed in days, not months.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":104,"product_name":105,"url":106,"description":107},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":109,"name":110,"problem":111,"products":112},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":156},"alkora-fined-200k-after-ransomware-exposes-40000-records-due-to-missing-dpia-and-weak-controls","Alkora Fined €200K After Ransomware Exposes 40,000 Records Due to Missing DPIA and Weak Controls","Alkora S.A.U. suffered a ransomware attack that encrypted and exfiltrated personal data belonging to approximately 40,000 individuals, including 75 minors, resulting in a €200,000 AEPD fine. The root failure was twofold: the organization lacked adequate technical and organisational security measures, and it failed to conduct a mandatory Data Protection Impact Assessment (DPIA) despite being aware of extreme cybercrime risks in its sector. Under GDPR Articles 25 and 35, organisations processing sensitive data at scale must proactively assess and mitigate privacy risks before incidents occur — not after. This case underscores that regulators will penalise both the breach itself and the failure to follow due-diligence processes that could have prevented or limited it. Insurance brokerages handling special-category or large volumes of personal data are particularly exposed if they treat DPIAs as optional.",[143,144,145,146,147,148,149,150,151,152,153,154,155],"GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 32 — Security of Processing","GDPR Article 35 — Data Protection Impact Assessment","GDPR Article 33 — Notification of a Personal Data Breach (72-hour rule)","NIST CSF PR.IP-1 — Baseline Configuration","NIST CSF RS.RP-1 — Response Plan Execution","NIST SP 800-30 — Risk Assessment Guide","CIS Control 3 — Data Protection","CIS Control 11 — Data Recovery","CIS Control 13 — Network Monitoring and Defence","CIS Control 17 — Incident Response Management","ISO\u002FIEC 27001:2022 — Annex A 8.8 Management of Technical Vulnerabilities","ISO\u002FIEC 27001:2022 — Annex A 5.29 Information Security During Disruption",{}]