According to BleepingComputer, Endesa and its Energía XXI operator notified customers that hackers accessed the company's systems and obtained contract-related personal data [1]. Spain's INCIBE said affected data includes basic identity, contact details, national ID numbers, contract data and possibly IBANs; according to BleepingComputer, passwords were not exposed and the company notified Spain's data protection agency [2][1]. INCIBE advises notified customers to be wary of callers claiming to represent known companies, verify identity before sharing anything, and hang up and call the official number when in doubt [2].
Backfill: this event became public on Jan 12, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillOfficially confirmed
Spain's Endesa notifies customers of a systems breach; ID numbers and IBANs may have been taken
1 min read
- Disclosed
- Jan 12, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
Timeline
Technical details
What happened
According to BleepingComputer, Endesa and its Energía XXI operator notified customers that hackers accessed the company's systems and obtained contract-related personal data, and that the company blocked a compromised internal account and notified Spain's data protection agency [1].
Impact
INCIBE said the exposed data includes basic identity, contact details, national ID numbers, contract data and possibly IBANs used for payment [2]. According to BleepingComputer, passwords were not exposed [1].
What to do
INCIBE advises customers to be careful with unsolicited calls and to verify them through the official phone number [2].
Remediation
Vendor guidance
- 1Verify callers verify[2]
Verify callers claiming to represent companies; when in doubt, hang up and call the official number.
References
Official / primary1
- [2]INCIBE2026-01-12Accessed 2026-11-11Snapshot 2026-11-11 sha256 d4dc8bc946d0
“Endesa ha informado a sus clientes sobre un ciberincidente por el que se ha accedido de forma no autorizada e ilegítima a ciertos datos personales de sus clientes: datos identificativos básicos, de contacto, DNIs y datos relativos a su contrato”
Media1
- [1]
Corrections
- · confirmation_status: media_reported → official_confirmedINCIBE（incibe.es）現已列為官方 CERT。其已存檔通報寫明 Endesa 已通知客戶發生未經授權存取合約相關個資的資安事件，並列出受影響資料類型（含身分證號與可能的 IBAN），且帳號密碼未遭外洩、事件已通報西班牙資料保護局。據此將 confirmation_status 改回 official_confirmed。
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.