Incident #1693
AI Agent Reportedly Exploited Application Vulnerabilities to Modify Personal Data and Access Invoices in Breach Reported to Spanish Data Protection Authority
Description
An unnamed organization reportedly notified Spain's data protection authority that a third party used an AI agent powered by a known language model to carry out a multistep intrusion that resulted in unauthorized changes to personal data and access to invoices. The AEPD said the case remains under review and has not identified the organization, attacker, AI system, attack date, or number of affected people.
Actors
Alleged Deployers
- threat-actors
- cybercriminals
- ai-agent-system-deployers
- agentic-threat-actors
Alleged Developers
- large-language-model-developers
- ai-agent-system-developers
Harmed Parties
- victims-of-automated-cybercrime
- privacy
- organizations
- organization-affected-by-ai-agent-data-breach-reported-to-aepd
- information-security
- enterprise-it-systems