[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB1IhsjsCdKAMIJ8lFPDOuvZnsMrRVY1gjwr6V4rql0k":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"70cb282b-98e6-408e-942e-556e433449c3","iberdrola-fined-1m-for-weak-phone-based-identity-verification-allowing-unauthorized-account-changes","dfad7e86-82a2-402b-91e3-b2885b7b9e59","Iberdrola Fined €1M for Weak Phone-Based Identity Verification Allowing Unauthorized Account Changes","Iberdrola Clientes failed to implement sufficiently strong authentication controls for customer identity verification over the phone, relying solely on static, easily obtainable data that could be exploited by unauthorized parties to alter sensitive contact details. This represents a fundamental failure in access control design, where knowledge-based authentication (KBA) using predictable or publicly accessible information provided no meaningful security barrier. The breach exposed customers to risks including account takeover, fraud, and privacy violations — all preventable with stronger multi-factor or dynamic verification methods. Under GDPR Article 25 (Data Protection by Design and by Default) and Article 32 (Security of Processing), organizations are legally obligated to implement appropriate technical and organizational measures, and failure to do so can result in substantial regulatory penalties as demonstrated by this €1,000,000 fine.","**Immediate actions:**\n- Replace static knowledge-based authentication (KBA) for phone verification with dynamic, time-sensitive one-time passcodes (OTPs) sent to a pre-registered channel.\n- Conduct an urgent audit of all customer-facing authentication processes to identify and remediate reliance on easily accessible static data.\n\n**Long-term improvements:**\n- Implement multi-factor authentication (MFA) for all sensitive account operations, including contact detail changes via any channel.\n- Embed Privacy by Design principles into all customer interaction workflows, ensuring security controls are evaluated before deployment.\n- Establish a formal identity verification policy with defined minimum standards reviewed annually against emerging threat intelligence.\n\n**Detection & monitoring measures:**\n- Deploy anomaly detection to flag unusual patterns in account modification requests (e.g., bulk changes, after-hours activity, or mismatched caller data).\n- Implement comprehensive audit logging for all account changes, with alerts for high-risk operations such as contact detail updates, and retain logs in accordance with GDPR requirements.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 32 – Security of Processing","NIST SP 800-63B – Digital Identity Guidelines (Authentication)","NIST AC-2 – Account Management","NIST IA-5 – Authenticator Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","ISO\u002FIEC 27001:2022 – A.8.5 Secure Authentication","ITIL 4 – Information Security Management Practice",{},"published","2026-07-08T12:21:25.92065+00:00","2026-07-08T12:21:25.825+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_EXP202406239&diff=52120&oldid=50902","aepd-spain-exp202406239-1ae5da","AEPD (Spain) - EXP202406239",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51],{"slug":52,"name":53,"problem":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in."]