AI Agent Reportedly Exploited Application Vulnerabilities to Modify Personal Data and Access Invoices in Breach Reported to Spanish Data Protection Authority

Summary

An unnamed organization reportedly notified Spain's data protection authority that a third party used an AI agent powered by a known language model to carry out a multistep intrusion that resulted in unauthorized changes to personal data and access to invoices. The AEPD said the case remains under review and has not identified the organization, attacker, AI system, attack date, or number of affected people.

Developers

• Large language model developers
• AI agent system developers

Deployers

• Threat actors
• Cybercriminals
• AI agent system deployers
• Agentic threat actors

Harmed parties

• Victims of automated cybercrime
• Privacy
• Organizations
• Organization affected by AI-agent data breach reported to AEPD
• Information security
• Enterprise IT systems