RCD Espanyol reports a security breach in its ticket and season ticket platform

RCD Espanyol has informed its members and subscribers of "a security breach" in its platform for ticket sales and subscription management. In a communication, the club points out that the incident affects "an infrastructure whose technical management is entrusted to an external and specialized technology provider." The Barcelona entity details that it was aware of what happened on August 28 and that the unauthorized access to the server would have occurred between August 5 and 13.

Espanyol notified the incident to the Spanish Data Protection Agency and police authorities. While the investigation remains open, the Catalan club warns that "possible access to this information could increase the risk of receiving fraudulent communications, identity theft attempts or social engineering actions that appear to come from the Club, financial entities or other known organizations."

Although the statement ensures that "misuse has not been confirmed", Espanyol warns its members that "depending on the information associated with each user and the type of relationship maintained with the Club, the potentially affected data could include name and surname, identification document, email address, telephone number and postal address."

Likewise, it recognizes that "in certain cases, they could also include the IBAN associated with members or subscribers or information related to minors." Sources familiar with the incident explain that a member has already reported to the club that their card with membership number and seat had been hacked. Currently, RCD Espanyol has 36,430 members and has reached 31,737 subscribers for the current season, exceeding the 31,711 registered at the end of last campaign.

The blue and white entity assures that, when it had sufficient knowledge of the characteristics and possible scope of the incident, it activated its response, containment and investigation procedures. "With specialized technical support, the affected systems have been isolated, the evidence necessary for the investigation has been preserved, the service has been restored on a new infrastructure, the corresponding credentials have been renewed and the applicable technical and organizational measures have been reinforced," the text details the measures that have been taken in recent weeks.