Threat actor claims the theft of full customer data from Spanish energy firm Endesa

Endesa disclosed a data breach that exposed full customer data, including contact details, national ID numbers, and payment information, after attackers accessed and may have exfiltrated data related to energy contracts, though passwords were not reportedly compromised. The company activated security protocols, blocked compromised access, and notified affected customers and authorities, with ongoing monitoring and supplier investigations.

A threat actor claimed on a cybercrime forum to have stolen 1.05 terabytes of data, publishing a thread stating the total size as 1,055,950,885,115 bytes and asserting more than 20,000,000 people were included in a single .sql file. Endesa notes there is no evidence of fraudulent use of the data at this time, which it says makes a high-risk impact unlikely, though impersonation, data publication, or phishing campaigns could still be attempted.

The firm confirmed that all operations and services continue normally, and it urged customers to stay alert for suspicious communications and to report concerns to Endesa or law enforcement if fraud is suspected. According to Endesa, the data breach affected its commercial platform and involves personal data of customers related to energy contracts.