Hackers steal millions of files of customer and employee data in Santander bank cyber attack

The bank reported the incident to authorities on Tuesday morning, with some 200,000 current and former workers, as well as customers in three countries, affected

Melchor Sáiz-Pardo

Madrid

Tuesday, 14 May 2024, 15:00

Opciones para compartir

Santander bank has been hacked, with information from some of its customers in Spain, Chile and Uruguay exposed to the cyber criminals.

The bank confirmed the incident this Tuesday (14 May) to Spain's National Securities Market Commission (CNMV), reporting it suffered "unauthorised access to a database".

Data on "all employees and some former employees of the group", with the exception of Germany, was also accessed by the hackers. This stacks up to be information on some 200,000 current and former employees.

The bank assured CMNV it "immediately" implemented measures to handle the incident, such as blocking access to the database and reinforcing fraud prevention to protect customers. Santander did not detail how many customers or what type of data has been affected, although industry sources claim that the files of millions of people, including personal data, have been affected.

However, the compromised information does not include highly sensitive data, such as passwords. "In the database there is no transactional information or access credentials or internet banking passwords that would allow transactions with the bank," Santander said in its communication to CNMV.

"Santander's operations and systems are not affected and customers can continue to operate normally," added the bank, which is already notifying all customers whose data has been breached.

A supplier

The cyber attack succeeded in penetrating their systems via a database hosted on a server managed by one of their suppliers. Attacks of this type, on companies working for banks, are the most common, because these outsourced firms tend to have more vulnerabilities than the parent company's security systems.

The bank chaired by Ana Botín said it regrets the situation and it is "proactively" informing "the customers and employees directly affected". Santander has also reported the incident to police, who have launched an investigation.

At present, all Spanish banks must immediately inform the Spanish Data Protection Agency (AEPD) and the European Central Bank (ECB), which has recently been conducting cybersecurity stress tests on all European institutions, of any data theft of this magnitude from their databases, in addition to the CMNV and the affected customers themselves. The ECB has already imposed heavy fines on banks that have notified authorities about hacking, but too late after the incident.

In March this year, Santander's Spanish customers reported a massive computer error in which duplicate charges appeared in their accounts. At the time, the bank said it was a "display error" and denied it was a case of unauthorised access to its systems, as has now occurred.

Top 50

Reporta un error en esta noticia