Spanish Telco Hit: Telefónica Database Leaked 17,817 User Records

HEROIC discovered 17,817 records in Telefónica on 9 January 2025, leaking email addresses, first names, and last names belonging to customers of the Spanish multinational telecommunications provider. Telefónica serves tens of millions of subscribers across Spain, Latin America, and Europe, so even this slice of data gives attackers a focused target list of real, verified account holders.

Why This Database Breach Is Dangerous for Telefónica Customers in Spain

This breach is dangerous because attackers can combine the leaked names and emails with public phone directories and prior stealer logs to mount convincing Spanish-language phishing, SIM swap, and fake support calls. Telecommunications identities are a stepping stone to banking one-time passwords and two-factor codes, making each leaked record far more valuable than the raw PII suggests.

What Was Exposed in Telefónica

• 17,817 Telefónica customer records
• Email addresses verified as active
• First and last names in Spanish formatting
• Country marker confirming Spain residency
• Language marker confirming Spanish-speaking targets

Why This Matters

Even though no passwords leaked in this dataset, name plus email tied to a major telco is exactly the starting material attackers need for SIM swap fraud. Once a phone number is ported away, criminals intercept one-time codes for banking, email, and crypto accounts, causing damage that can take months to reverse.

How Database Breaches Work

Database breaches at a carrier the size of Telefónica typically exploit a vulnerable partner portal, an exposed API endpoint, or stolen admin credentials from an earlier stealer infection. Attackers quietly dump customer tables, stage the data on their own infrastructure, and then post it on forums such as BreachForums, where it is packaged into combo lists and sold to lower-tier fraudsters.

Check If You Are Affected

HEROIC scans more than 400 billion compromised records, including the Telefónica dataset, so you can see in seconds whether your email and name appear in this breach. Run a free HEROIC scan, set a SIM swap PIN or port-out protection with your carrier, and stay alert to any Spanish-language email or SMS claiming to be from Telefónica customer service.