Phone House Spain ransomware breach

On 8 April 2021, The Phone House España — the Spanish arm of the European mobile-phone retail chain (part of Dixons Carphone) — was struck by a ransomware attack carried out by the Babuk gang. When the company declined to pay, the attackers dumped roughly 100 GB of customer data online, in one of Spain's most consequential retail breaches.

What happened

Babuk, a ransomware-as-a-service operation that emerged in early 2021, encrypted Phone House systems and exfiltrated internal databases before deploying its locker. Following the now-standard double-extortion model, the group listed the company on its dark-web leak site on 11 April and started a public countdown demanding payment to prevent publication.

The Phone House refused. On 22 April, the attackers released the full trove. While Babuk boasted of data on 13 million customers, subsequent analysis — including by Spain's national CERT, INCIBE — concluded the genuinely affected population was closer to 3 million individuals, spanning current customers, former customers, employees and suppliers.

Impact

• The leaked data included full names, national ID (DNI) numbers, home addresses, email addresses, phone numbers, nationalities, dates of birth and banking details, alongside device-related records such as IMEI codes and insurance policy information.
• Because the dump was published in full, exposed individuals faced lasting risks of phishing, identity theft and SIM-swapping fraud — risks that cannot be revoked once data is public.
• The breach quickly populated Have I Been Pwned and other monitoring services, allowing customers to confirm their exposure.

Regulatory aftermath

On 27 December 2023, Spain's data protection authority, the AEPD, fined The Phone House €6.5 million — one of the largest sanctions ever issued against a Spanish retailer. The penalty broke down into €4 million for violating GDPR Article 5.1(f) (integrity and confidentiality) and €2.5 million for breaching Article 32 (security of processing). Investigators found the company had relied on an insecure encryption algorithm and lacked adequate technical and organisational safeguards for the volume and sensitivity of personal data it held.

Why it matters

The Phone House case underscores that, under GDPR, refusing the ransom does not end the liability. Even when a victim correctly declines to pay criminals, regulators will examine whether the underlying security failures made the breach possible in the first place. For a retailer holding identity and banking data on millions of consumers, weak encryption and insufficient controls translated directly into a multi-million-euro fine — independent of, and additional to, the reputational damage of the public leak itself.