Vodafone Group—Spain's AEPD fined Vodafone España EUR1.65M across three decisions over 2023 ransomware breaches and vendor-oversight failures

Spain's data protection authority (AEPD) issued three separate GDPR fines totaling EUR1.65 million against Vodafone España, announced September 17-18, 2026, stemming from ransomware attacks in late 2023. A EUR500,000 fine covered a breach on a Vodafone-managed platform affecting 724,733 customers, citing inadequate security measures under Article 32. A EUR400,000 fine (split EUR100,000 under Article 28 and EUR300,000 under Article 32) covered a breach at a call-center service provider affecting 486,768 customers, where the underlying data-processing agreement was found to have been signed after the breach occurred despite being backdated. A EUR750,000 fine covered a breach of the Super WiFi service managed by third-party vendor Plume, citing Articles 5(1)(f), 28, and 32. The AEPD's findings centered on governance failures rather than the attacks themselves: weak maintenance-account credentials without multi-factor authentication, inadequate third-party vendor oversight, delayed patching of known vulnerabilities, and missing data-processing agreements. Vodafone appealed the EUR750,000 Super WiFi fine to Spain's Audiencia Nacional.