Personal Data Breach Reported in Spain Linked to an Attack Carried Out by an Artificial Intelligence Agent

The breach occurred prior to 14 September 2026, when the AEPD reported that it had received the first notification in Spain of a case in which the attack was allegedly carried out using an artificial intelligence agent. The affected entity is a Spanish organisation whose identity has also not been disclosed.

According to the notification, the agent searched for vulnerabilities in generic files, successfully logged in and autonomously examined the application until it located a flaw that allowed it to modify personal data and access invoices. Neither the number of people affected nor the volume of information compromised has been specified. The organisation reported the breach to the AEPD, but no further response measures have been published.

The latest official update states that the AEPD is continuing to analyse the information provided by the organisation; therefore, there are no definitive conclusions regarding the incident. Nor has it been confirmed whether the language model or its provider’s infrastructure were compromised or used for malicious purposes. It has not been publicly disclosed whether the access was contained or whether the modified data was restored.