Cyber Incident Victim: Banco Santander
Date:
Oct 2020
Location:
Spain
Summary
A financial institution's international money transfer service experienced a data breach involving third-party software developer systems, resulting in the theft of approximately 2GB of internal documents including infrastructure details, procedural guidelines, and cybersecurity policies. The organization confirmed detecting the leak earlier, asserting no compromise of core systems or access to sensitive customer information or payment data, while characterizing public claims about the incident as significantly exaggerated. Law enforcement initiated an investigation into the cyber intrusion, with the entity maintaining that its payment infrastructure remained secure and customer operations unaffected.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In late October 2020, an anonymous source contacted The Register alleging that approximately 2GB of internal data from Santander’s international money transfer service PagoFX had been stolen and offered for sale on an underground hacking forum. The claimed breach included database schemas, infrastructure documentation, digital risk assessments, customer security checks, and Salesforce training materials. According to the report, the files originated from a compromised third-party software developer engaged by PagoFX rather than direct infiltration of Santander’s systems. Santander confirmed detecting a data leak in August 2020 but declined to elaborate on specifics beyond stating its core banking infrastructure remained unaffected. The bank characterized the incident’s severity as overstated, emphasizing that no sensitive personal information or payment data was accessed during the breach.
Santander’s public response clarified that PagoFX’s internal systems were not compromised and reiterated the security of its payment infrastructure. Analysis of the leaked data indicated it primarily contained non-critical materials such as sample source code, internal procedural documents, and cybersecurity policy templates rather than operational customer data or financial records. The bank assured customers that services could continue uninterrupted and described the exposed information as posing no direct risk to user accounts or transactions. Law enforcement agencies initiated an investigation into the cyber intrusion, though no further details regarding suspects or attribution were disclosed. Santander maintained its position that the incident did not impact its operational integrity or customer security throughout subsequent media inquiries.