🚨 CYBER INTELLIGENCE ALERT: 🇪🇸 [UNCONFIRMED] ALLEGED TELECOMMUNICATIONS CUSTOMER BREAK — NETLLAR GROUP (MASORANGE)
[STATUS: UNCONFIRMED / VISIBLE EVIDENCE]
A recent post has been detected on underground cybersecurity forums, issued by the threat actor calling himself "fuerzayhonor," claiming to have perpetrated a massive data breach against the Netllar Group in Spain. According to the attacker, the provider's infrastructure had never been compromised before, thus classifying the information as entirely new.
The actor claims that the data breach not only directly affects Netllar users, but also includes customer databases belonging to other subsidiaries and brands operating under the same network and agreements:
Netllar
Oceans
Octel
Europanetwork
📂 Data Dump Details and Exposed Data Schema (PII)
Threat Actor: fuerzayhonor
Volume: More than 50,000 unique customer records.
Structured Data Schema (Sample Validation):
Upon verifying the raw sample provided by the attacker, it was found that the records expose high-fidelity Personally Identifiable Information (PII) fields corresponding to individuals and legal entities primarily located in the regions of Alicante, Valencia, Madrid, and Almería (Spain). The form explicitly includes:
Full Name: Names and surnames of the account holders, along with the company name if applicable.
National Identification Number: The DNI/NIF/NIE number (essential tax identification numbers in Spain, ending with their respective letter control code).
Residential Geolocation: Complete home addresses specifying streets, avenues, housing developments, building numbers, floors, postal codes, and corresponding municipalities.
Active Contact Data: Personal, business, and official corporate email addresses (e.g., @hotmail.com,
@gmail.com accounts, as well as banking and sector-specific emails like
@bbva.com or
@ubs.com), accompanied by their respective landline or mobile contact numbers.
⚠️ Risk and Tactical Impact Considerations
Targeted Smishing and Vishing Campaigns: Breaches at telephone companies and ISPs in Spain are immediately exploited by local fraud rings. Armed with the victim's name, national ID number (DNI), address, and the specific fiber/mobile service provider (e.g., Netllar/Oceans), attackers execute the classic "double-call scam" or mobile number portability fraud. They call pretending to be from the provider (e.g., Netllar) to announce a fake rate hike; hours later, a fraudulent entity contacts the victim with a "counter-offer," stealing their banking details in the process.
Account Takeover (SIM Swapping): Although the sample displays customer profile data, if the full data dump includes SIM card ICCID numbers or mobile contract details, there is an exponentially higher risk of threat actors attempting SIM swaps to intercept SMS verification codes and compromise bank accounts.
🛡️ Recommended Actions (Defensive and Investigative)
Hardening Customer Authentication Processes: Instruct fraud departments handling Spanish user bases to tighten identity validation filters. Following this breach, verification based solely on name and national ID (DNI) should no longer be considered a secure or sufficient factor for authorizing critical account changes or transfers, as this data is now compromised. Credential Reuse Audit: Advise organizations using the email addresses found in the sample to proactively change their passwords, given the risk that attackers might use the extracted combinations for credential stuffing attacks against other platforms.
VECERT TOOLS
Strategic Monitoring Tools & Intelligence Platform:
🌐
analyzer.vecert.io
Security Verification & Monitoring:
🛡️
monitor.vecert.io
#CyberSecurity 🔐
#Spain 🇪🇸
#Netllar #MasOrange #DataBreach 📁
#PII #DNI #FinancialInvestigation 💸
#ThreatIntelligence 📊
#StrengthAndHonor #VECERT 🏢