All articles

Published on · Spain

Endesa: customer IDs and IBANs left through an internal account

In January 2026 Endesa, Spain's large electricity company, and its brand Energía XXI confirmed that someone got into their commercial platform. Not through a hole in the website: through internal accounts, the logins of people who work there. Customers' identity details, contacts, ID numbers and IBANs were exposed.

In 30 seconds

  1. Someone got into Endesa's commercial platform using compromised internal accounts.
  2. Customers' identity, contacts, ID numbers (DNI), contract data and IBANs were exposed.
  3. The lesson for everyone: an internal account is a key to the office. Protect it with two-step verification.
When
Disclosed in January 2026
Who
Endesa and Energía XXI, Spain
How they got in
Compromised internal accounts (how was not said)
What they took
Identity, contacts, DNI, contracts, IBANs

What happened

In January 2026 Endesa and its retailer Energía XXI disclosed unauthorised access to their commercial platform, where customers' contracts are kept.

According to the disclosure, identification details, contact information, Spanish national ID numbers (DNI), contract details and payment details including IBANs were exposed. Customer account passwords, the company says, were not.

Endesa blocked the compromised internal accounts, is analysing its logs, informed the Spanish data protection authority and is notifying customers. The number of customers affected has not been disclosed.

How they got in

Through internal accounts: real logins of people who work on the platform. How they were compromised has not been made public, and we do not guess.

Around the same time a seller posted what they claim are samples of the stolen data and spoke of 20 million records. That is their claim: Endesa has not confirmed it.

Why this matters for a small business too

You do not need to be a giant. Every business has internal logins: the management software, email, the website admin panel, online banking. If one falls into the wrong hands, whoever gets in does not need to force anything: they come in as an employee and see what that employee sees.

And once customers' names, contracts and IBANs are out, an email or a call in the company's name becomes believable to whoever receives it.

What to check in your business today

  1. Turn on two-step verification for every internal login: staff, outside collaborators, suppliers.
  2. When someone leaves, close their logins the same day, not the month after.
  3. Everyone sees only what they need: the person doing deliveries should not be able to download every customer IBAN.
  4. If customer data is stolen, warn your customers straight away: the fake emails in your name will reach them.

Sources