Quick links
Press Enter to search, Esc to close
Significant cyber incident
In May 2024 Santander said an unauthorized party had accessed a database hosted by a third-party provider.
In short
In May 2024 Santander said an unauthorized party had accessed a database hosted by a third-party provider. The bank confirmed that certain information on customers of Santander Chile, Spain and Uruguay, and on all current and some former Santander employees of the group, had been accessed. It said the database held no transactional data and no online banking credentials. The statement gives no numbers and names no attacker.
On 14 May 2024 Santander published a statement in Madrid. It said the bank had recently become aware of unauthorized access to a Santander database hosted by a third-party provider.
After an investigation, Santander confirmed that certain information relating to customers of Santander Chile, Spain and Uruguay had been accessed. It also said the information of all current and some former Santander employees of the group had been accessed. Customer data in all other Santander markets and businesses was not affected.
Santander said the database held no transactional data and no credentials that would allow transactions, including online banking details and passwords. It said the bank’s operations and systems were not affected, so customers could keep transacting securely.
The statement does not say how many people were affected, what the stolen fields were beyond this description, who the third-party provider was or who carried out the access. We did not use unofficial claims about the size or sale of the data, because we could not verify them from an official page or from two major news outlets.
Santander becomes aware of unauthorized access to a database hosted by a third-party provider.
The bank blocks the compromised access to the database and adds fraud prevention controls.
After an investigation, Santander confirms which customers and employees are covered.
Santander publishes its statement in Madrid.
Santander says it is contacting affected customers and employees directly and has notified regulators and law enforcement.
The only official account we could open is Santander’s own statement. It describes the event as unauthorized access to a Santander database hosted by a third-party provider. It does not say how the access was obtained, how long it lasted or which data fields were taken, beyond saying that no transactional data and no credentials allowing transactions were in the database.
The data sat with a supplier, not on the bank’s own systems. Santander says the bank’s own operations and systems were not affected. The case shows that a company’s data risk includes every supplier that holds a copy of it.
We make no claim about the attack chain, because no source we could open describes it.
No public attribution in the official statement of 14 May 2024. Santander's statement names no attacker.
Santander, 14 May 2024: certain information on customers of Santander Chile, Spain and Uruguay, and on all current and some former Santander employees of the group, was accessed. Customer data in all other markets and businesses was not affected.
The database held no transactional data and no credentials that would allow transactions on accounts, including online banking details and passwords. The bank's operations and systems were not affected.
The statement gives no count of people or records. Figures that circulated elsewhere are not used here because we could not verify them.
Spain’s data protection authority (AEPD) says a breach that risks people’s rights must be notified to it within a maximum of 72 hours of becoming aware. We did not find an AEPD decision on this incident.
The access was to a Santander database hosted by a third-party provider. List every supplier that stores copies of customer or staff data.
Santander said it was contacting affected customers and employees directly. Direct notice lets people watch for fraud sooner.
The bank said the database held no transactional data and no online banking credentials. A clear statement of what is out of scope reduces panic and unneeded password resets.
Santander set up extra fraud prevention controls while it investigated. Plan which controls you can switch on within hours.
The AEPD expects notice of a breach that risks people's rights within 72 hours of awareness. Decide in advance who files.
List which suppliers host databases that contain customer or employee data, and what fields they hold.
Check who can log in to supplier-hosted databases, how, and whether multi-factor authentication is required.
Confirm that supplier-hosted copies hold only the fields they need, and that credentials and transaction data are kept elsewhere.
Check that supplier contracts require fast notice of any unauthorized access to your data.
Write down who tells regulators, law enforcement, customers and staff, and in what order, with the 72-hour AEPD clock in mind.
Agree which fraud checks you would tighten for customers whose details were exposed.
On 14 May 2024 it said there had been unauthorized access to a Santander database hosted by a third-party provider.
Certain information on customers of Santander Chile, Spain and Uruguay, and on all current and some former Santander employees of the group. Customer data in all other markets was not affected.
Santander said no transactional data and no credentials that would allow transactions, including online banking details and passwords, were in the database.
The statement gives no number. We do not repeat unofficial figures.
No public attribution in Santander's statement.
Santander said it had notified regulators and law enforcement.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.