The security breach suffered by Endesa is worse than previously thought, it has emerged.
According to watchdog FACUA-Consumidores en Accion, the incident has also compromised the personal data of former users – both of Endesa itself and of its regulated supplier, Energía XXI.
The consumer organisation says it has verified that people who no longer hold any active contract with either company have also received notifications informing them that their personal information may have been affected.
Among the cases identified are former customers who have had no contractual relationship with Endesa or Energía XXI since as far back as 2021, significantly widening the time span of the data exposure.
FACUA has requested clarification from the energy company on how far back the affected former customers go. However, the association claims that Endesa has so far failed to respond to this request.
Endesa did not respond to the Spanish Eye’s request for comment.
In light of the lack of information, the organisation has escalated the matter by formally contacting the Agencia Española de Proteccion de Datos, urging it to open an investigation into the incident.
The aim is to establish what happened, determine whether Endesa bears responsibility, and assess whether sufficient measures have been put in place to prevent further security breaches.
In the notification sent to both current and former customers, Endesa and Energía XXI acknowledge that there was an ‘unauthorised and illegitimate access to their commercial platform’, an incident which ‘compromised the confidentiality of certain data for which Endesa Energía is responsible’.
Spain’s Instituto Nacional de Ciberseguridad (Incibe) has issued an alert in relation to the breach.
According to the company, the affected information includes ‘basic identification and contact details, national identity numbers (DNIs), and data relating to customers’ contracts with Endesa’, as well as, ‘in some cases, payment details such as IBANs’.
Endesa has stressed, however, that ‘at no point were password access details compromised’, in an apparent attempt to limit the perceived scope of the leak.
