Vodafone Group

Citing a record 313 deliberate internet shutdowns across 52 countries in 2025 affecting roughly 800 million people, Vodafone Group published a report calling on governments to treat network shutdowns only as an exceptional last resort. Chief External & Corporate Affairs Officer Joakim Reiter proposed a 'Transparent Governance Framework' requiring a clear legal basis, a legitimate public policy objective, evidence of necessity and proportionality, written orders, independent oversight, access to judicial challenge, and public reporting on rationale and impact for any shutdown.

Spain's data protection authority (AEPD) issued three separate GDPR fines totaling EUR1.65 million against Vodafone España, announced September 17-18, 2026, stemming from ransomware attacks in late 2023. A EUR500,000 fine covered a breach on a Vodafone-managed platform affecting 724,733 customers, citing inadequate security measures under Article 32. A EUR400,000 fine (split EUR100,000 under Article 28 and EUR300,000 under Article 32) covered a breach at a call-center service provider affecting 486,768 customers, where the underlying data-processing agreement was found to have been signed after the breach occurred despite being backdated. A EUR750,000 fine covered a breach of the Super WiFi service managed by third-party vendor Plume, citing Articles 5(1)(f), 28, and 32. The AEPD's findings centered on governance failures rather than the attacks themselves: weak maintenance-account credentials without multi-factor authentication, inadequate third-party vendor oversight, delayed patching of known vulnerabilities, and missing data-processing agreements. Vodafone appealed the EUR750,000 Super WiFi fine to Spain's Audiencia Nacional.

In October 2025, the newly merged VodafoneThree entity informed staff that planning and optimization jobs in its UK Network Development division would be offshored to India under new contracts with Ericsson and Nokia. Permanent staff were told they were 'at risk of redundancy' and employment protections wouldn't apply. Employees noted 'the merger was supposed to create jobs for the UK.' This is part of Vodafone's broader plan to cut 55,000 jobs by 2030.

Germany's Federal Commissioner for Data Protection (BfDI) imposed a combined €45 million in fines on Vodafone Germany, its largest since GDPR took effect, after finding eSIM authentication vulnerabilities that exposed customer profiles to unauthorized access and inadequate oversight of retail partner agencies that enabled fraud. The BfDI noted Vodafone cooperated throughout the investigation, disclosed incriminating circumstances, and has since revised partner-vetting procedures and agreed to follow-up compliance checks.