Endesa data breach with personal and banking information compromised
Endesa reported a breach with identifying and contact data, national ID, IBAN and contract details; according to the company, no passwords were compromised.
What happened
Endesa reported a breach with identifying and contact data, national ID, IBAN and contract details for Endesa Energía customers. According to the company, no passwords were compromised.
Why it matters
The main risk is impersonation and tailored fraud using that data. Whoever holds the national ID, the IBAN and the contract details can call claiming to be your energy supplier and sound credible, because they know exactly which contract you have, whose name it is in and where it is charged. The victim does not have to be careless: the call only has to arrive at a moment when changing the bank account looks routine. That no passwords were compromised limits the scope, but it does not make the fraud any less credible. The fraud arrives by phone or email, with true data and a request that looks administrative.
What we recommend
Verify any payment request or change of bank account through an independent channel, and warn administration and finance about this type of fraud. The call should be ended and made again on the number already on file, never on the one the caller provides. In a company, warning finance matters as much as warning the affected customer. If a detail has already been given, it is worth telling the bank and changing the collection account as soon as possible.
Related service: ciberseguridad
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.