NewAI pentesting that proves every finding
INSECUREWEB

Data Breach News2 min read

Santalucía Seguros Spain Leak: 2.8M Sample Records

By InsecureWeb Team

This report reflects observations of dark web activity. InsecureWeb makes no representations regarding the accuracy of this data.

Santalucía Seguros Spain Leak: 2.8M Sample Records

Data Breach Summary

A leak surfaced on DarkForums.st in March 2025 by user N4t0x, revealing approximately 2.77 million sample entries from Santalucía Seguros, Spain’s major insurance provider. The CSV data exposes personal information—including email addresses, phone numbers, addresses, and timestamps—from customers dating back to 2018. This follows a separate breach instance in May 2025 attributed to threat actor Vaquilla, who claimed access to the full database and released a small sample of 13 records X (formerly Twitter)LinkedIn.

Where and How?

  • Source of Leak: Dark web forum DarkForums.st, March 2025 by user N4t0x
  • Format: Large CSV files covering contacts, customers, lost sales, and more
  • Exposed Data: PII including email, phone, addresses, names, password hashes, and registration dates (recorded sample entries reflect Nov 10, 2018 timestamps)

Company Data Breach History

  • March 2025 Leak: 2.77 million sample records by N4t0x
  • May 28, 2025 Incident: Vaquilla reportedly exfiltrated the entire database (~3 million records), publishing a 13-record sample
  • No other prior breaches of Santalucía Seguros have been reported.

Recommendations for Affected Individuals

  • Change passwords for any accounts using Santalucía credentials.
  • Enable two-factor authentication where feasible.
  • Stay vigilant for phishing emails or SMS referencing insurance or password resets.
  • Monitor financial statements for abnormal activity or charges.

Organizational Security Recommendations

  • Audit and reinforce cloud database security and access control.
  • Encrypt all PII both at rest and in transit.
  • Implement intrusion detection and enhanced logging on database access.
  • Conduct phishing awareness training for staff and customers.
  • Notify authorities and affected customers transparently and promptly.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.

More breach reports