Spain’s AEPD Fines Bankinter €240,000 Over 2024 EVO Banco Data Breach Spain’s data protection authority (AEPD) has concluded its investigation into a 2024 cyberattack on EVO Banco, imposing a €240,000 fine on Bankinter after the lender absorbed EVO Banco through a merger. The breach, which exposed sensitive personal and financial data of over 1.27 million individuals, stemmed from an API vulnerability introduced during a system migration in February 2024. The flaw, approved through EVO Banco’s internal change management process, removed access controls on an API used in customer onboarding, allowing unauthenticated queries to retrieve data. Between 23 and 27 March 2024, the vulnerable endpoint processed 5.47 million requests, with 1.27 million successfully accessing personal records. Exposed data included names, national identity numbers, IBANs, employment details, VAT declarations, and income levels far exceeding the bank’s initial characterization of the breach as limited to basic identifying information. EVO Banco only detected the incident on 8 April 2024 after a third-party cybercrime monitoring service flagged a Dark Web post advertising a database of 1.3 million customers. The attacker, who joined the forum weeks earlier with minimal reputation, later demanded a ransom, publishing data for 958 clients and four employees when EVO Banco refused to pay. The bank filed a police report on 22 April 2024, though forensic analysis could not confirm whether the full dataset was exfiltrated. The AEPD’s investigation identified three critical security failures: the API’s lack of authorization checks, unencrypted personal data, and a change management process that failed to test for access control vulnerabilities. While EVO Banco initially classified the breach as low-risk and declined to notify affected individuals, the AEPD intervened on 18 April 2024, ordering mandatory disclosures under GDPR Article 34. The proposed fine of €400,000 was reduced to €240,000 after Bankinter acknowledged liability and paid voluntarily in November 2025. The AEPD cited aggravating factors, including the scale of exposed financial and identity data, but applied mitigations due to the merger, which transferred legal responsibility to Bankinter following EVO Banco’s deregistration in April 2025. The case underscores the risks of inadequate API security and the limitations of internal risk assessments when financial data is involved. It also highlights the AEPD’s enforcement focus on data processing governance, with recent fines against Informa D&B (€1.8M), FC Barcelona (€500K), and Yoti (€950K) reinforcing its scrutiny across sectors.