Iberdrola Exported 3,221 Databases

Data Breach Summary

A major leak involving Iberdrola surfaced on Darkforums.st, published by the user N4t0x. On May 3, 2024 at 10:45:17 GMT-7, a total of 3,221 files were exfiltrated from a Google Drive account and exported to the email address produccionteleoperadores@gmail.com. These files include multiple internal databases, such as customer service conversations from various Spanish offices.

The exposed data contains sensitive personal information including phone numbers, full names, national ID numbers (DNI), addresses, and full IBANs—posing serious risks for identity theft and financial fraud.

---

Where and How?

The database was shared through Darkforums.st, where a user highlighted that the leak was part of an export operation directly from Google Drive. The exported content includes detailed client information from Iberdrola, indicating a possible internal mismanagement or compromise of access credentials. The leak includes structured personal data, likely pulled from CRM or support databases linked to Iberdrola operations.

Company Data Breach History

This leak follows a previously confirmed breach in May 2024, where 850,000 Iberdrola customers were affected due to a third-party vendor compromise. In that incident, personal data such as names, DNI, and contact information was circulated through Telegram and dark web channels. However, this Darkforums leak appears to be separate and more severe, given the presence of internal databases and full banking data (IBANs).

There are no current public statements or media acknowledgments by Iberdrola regarding this specific Darkforums dump.

---

Recommendations for Personal Data Protection

Users potentially affected by this breach should:

• Immediately change any passwords associated with Iberdrola accounts or linked emails.
• Monitor bank accounts for unauthorized transactions.
• Be cautious with any unsolicited communications requesting personal information.
• Enable two-factor authentication wherever possible.
• Report suspicious activity to relevant financial institutions and data protection authorities.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.