The leading Spanish telecommunications company, Telefónica has confirmed that its internal ticketing system was breached following the unauthorized release of sensitive data on a hacking forum. The breach was disclosed after 2.3 GB of internal documents and tickets were leaked, allegedly stolen using compromised employee credentials.
In an official statement shared with BleepingComputer, Telefónica acknowledged the intrusion: “We have become aware of unauthorized access to an internal ticketing system which we use at Telefónica. We are investigating the extent of the incident and have taken the necessary steps to block unauthorized access to the system.”
The breach reportedly occurred yesterday and was carried out by four attackers identified by their aliases: DNA, Grep, Pryx, and Rey. According to Pryx, one of the perpetrators, the targeted system was Telefónica’s internal Jira development and ticketing server, which was used to log and address internal operational issues.
The attackers claim to have extracted a trove of data using stolen employee credentials, including internal tickets and documents. Some of the records were labeled as customer-related, though initial indications suggest these may represent tickets raised on behalf of customers using @telefonica.com email addresses. Telefónica has since taken action by blocking unauthorized access and resetting passwords for the compromised accounts.
The attackers did not contact Telefónica or issue any ransom demands before releasing the stolen data, suggesting their intent was not monetary extortion but public exposure of the breach.
Further scrutiny reveals that three individuals involved in the Telefónica attack—Grep, Pryx, and Rey—are linked to the recently established Hellcat Ransomware operation. This group is also implicated in a separate breach of Schneider Electric, where they reportedly exfiltrated 40 GB of data from the company’s Jira server.
As Telefónica operates in 12 countries and employs over 104,000 people, this breach raises concerns about the cybersecurity measures in place to safeguard its extensive infrastructure. Telefónica is the largest telecommunications provider in Spain, operating under the brand name Movistar, and has a significant role in the global telecom sector.
