Security Incident in Levante UD Systems With Possible Impact on Personal Data

On September 30, 2026, Levante UD detected a security incident while updating its monitoring system. The investigations completed by the time of the public notice linked the incident to an external attack that may have gained unauthorized access to its systems. The club stated that personal data relating to members, season-ticket holders, players and online store customers may have been affected, without specifying when the activity began.

The potentially affected information includes names, national identity numbers, dates of birth, contact details, financial information excluding payment methods, and data relating to minors, health and biometric templates. The club blocked the affected servers, closed remote access, changed credentials, introduced two-factor authentication, restricted and encrypted backups, preserved evidence, reviewed internal policies and engaged external specialists.

The latest communicated status indicates that the investigation remains open. Levante UD stated that it had no evidence of fraudulent use or data exfiltration, notified the incident to the Spanish Data Protection Agency and said that any additional information would be provided to those affected. The number of affected individuals or records, the final scope of the incident and the identity of those responsible have not been publicly disclosed.