An investigation has been conducted into a significant cybersecurity incident that occurred in 2025 at Telefónica, a global telecommunications company serving millions across Europe and Latin America. In addition to allegedly obtaining a considerable cache of confidential corporate data from the company's systems, a threat actor has claimed responsibility for a breach of the company's systems.
Additionally, the hacker claims that sensitive internal information has already been leaked online by the hacker. This has caused heightened alarm within both the cybersecurity community and regulatory bodies worldwide, as both have been concerned about this development.
Even though the suspected breach has raised concerns that even the most well-established businesses are increasingly vulnerable to cyber threats, it raises urgent questions about the overall resilience of multinational corporations against the increasingly sophisticated cyber threats we face today.
It is still unclear what exactly the extent of the compromise is, but experts warn that such incidents can have far-reaching consequences, not only in terms of operational disruption and financial impact, but also in terms of damaging the reputation of the company's customers. Telefónica is a large and important part of the global communication infrastructure, and any verified exposure of their business reputation, compliance obligations, and customer relationships could be severely affected if the information were disclosed.
The case, which is being analysed by authorities and cybersecurity specialists to assess whether the hacker's claims are genuine and scope-based, is proving to be an important reminder of how cyber risk continues to evolve in the digital age. As a result of a targeted cyberattack on its internal systems, Telefónica, the multinational telecommunications provider headquartered in Madrid, has been officially informed that its systems have been compromised.
This company disclosed that, due to the breach, unauthorised access has been granted to over 236,000 customer data entries.
A total of approximately half a million Jira development and support tickets have been stolen as a result of the breach, including critical records that are often associated with internal communication, technical workflows, and potentially sensitive information about the company's operations.
Based on the type of data exposed, it has been suggested that the attackers may have been able to gain deep insight into Telefónica's internal processes, project management infrastructure, and customer interactions.
There are serious risks involved not only for those affected, but also for the organisation's operations, security and competitiveness if there is a security breach.
There is concern that Jira platforms, which are commonly used for software development and IT service management, may contain detailed information about system configurations, troubleshooting logs, and network vulnerabilities, a feature that makes the breach particularly alarming to cybersecurity researchers.
Despite early indicators that indicate a sophisticated and well-planned intrusion, forensic investigations continue to indicate that the attacker may have exploited system misconfigurations and weaknesses in user credentials in order to launch the attack. In cyberattacks, adversaries are increasingly trying to steal both data and disrupt long-term strategic goals by exploiting vulnerabilities in their systems.
The scale and specificity of the data accessed reflect this trend.
There is a growing sense that global telecom providers have to strengthen their digital defences and become more transparent when reporting incidents. As a result of emerging reports, it has been confirmed that the data breach occurred after Telefónica's Jira database appeared on a notorious hacker forum, which increased the pressure on them to improve their cybersecurity.
Apparently, the disclosure was made by four individuals using the aliases DNA, Grep, Pryx, and Rey, now associated with Hellcat Ransomware, one of the more active cybercriminal groups that has surfaced recently in recent times. It has been claimed that the intruders have compromised Telefónica's internal ticketing system, which is based on the Jira platform, a common software development, issue tracking, and workflow management platform used by many organisations.
As of early this week, the attackers were able to gain access to the telecom's internal systems by using compromised employee credentials, which enabled them to penetrate the company's internal systems. After entering, the attackers were able to exfiltrate around 2.3 GB of data, including technical tickets, internal documentation and other documents.
It appears that some of the data was associated with the customers, though the tickets were submitted through @telefonica.]com addresses, suggesting that employees might have logged the tickets on behalf of clients, rather than the customers themselves. Several new details have emerged indicating that one of the key people responsible for the Telefónica breach, known as “Rey,” is an individual who self-identifies as one of the Hellcat Ransomware group members.
It is important to note that this is not the first time Telefónica has been attacked by the same threat actor. Rey was also responsible for another breach that occurred in January 2025. That breach also used the company's internal Jira ticketing and development server to exploit a similar vulnerability. It seems that the recurring attack indicates that the internal infrastructure of the telecom giant has persistent security weaknesses.
Rey has claimed in a statement to the cybersecurity report that he has exfiltrated an enormous amount of data from the most recent incident, including 385,311 files totalling 106.3 gigabytes of data in total. It is reported that the data in question includes an array of internal materials, including service tickets, internal emails, procurement documents, system logs, customer records, and personal details related to sensitive employees.
If this data is verified, it could constitute a substantial breach of operational and personal data based on the volume and sensitivity it reveals. A misconfiguration in Telefónica's Jira environment, which occurred even after the company responded to a similar incident earlier in the year, was attributed to the success of the intrusion that occurred on May 30.
A recent revelation has prompted a renewed concern within the cybersecurity community over Telefónica's patch management and remediation processes, especially since the same vulnerability was allegedly exploited twice within the last six months.
It has been noted by industry experts that these kinds of lapses not only compromise data security but also undermine the confidence of customers and compliance with regulations.
Repeated targeting by the same group demonstrates that modern cyber threats have evolved and persist for quite a while and that they are exploiting both technical vulnerabilities as well as organisational inertia.
Security experts continue to emphasise the importance of not only addressing incidents, but also conducting comprehensive audits and hardening of infrastructure as a means of preventing recurrences.
Atypically, the perpetrators of ransomware campaigns did not contact Telefónica. They did not issue any demands to the company or attempt extortion before releasing the stolen information publicly.
Security researchers have expressed concern over the unusual and concerning nature of this approach, suggesting that there may be a motive other than financial gain, such as disrupting or making a name for oneself.
The Telefónica team responded to the breach by resetting the credentials of the affected accounts and barring further access via the compromised login information after the breach was identified.
Although these mitigation measures were enacted swiftly, cybersecurity analysts are warning of the possibility that the leaked data may be wweaponisedin phishing and social engineering attacks in the future.
A warning is being issued to individuals and organisations associated with Telefónica to remain vigilant against suspicious communications and attempts to exploit the breach for fraudulent purposes.
Following the breach, the stolen data was first spread through the use of PixelDrain, a platform for sharing and storing files online.
The content, however, was removed within a matter of hours due to legal and policy violations. The threat actor circulated a new download link using Kotizada, an alternative file-hosting service, as a response to the removal.
A recent study has shown that Kotizada is a potentially dangerous website that has been flagged by Google Chrome, with browser security systems strongly advising that users should stay away from the site or avoid it entirely.
The attacker has observed a pattern of evasion and re-hosting to maximise exposure while circumventing takedown efforts.
In the meantime, Telefónica has not yet released an updated public statement clarifying whether the leaked information is based on newly compromised data or whether it is based on previous incidents.
Some popular firms reported that some of the email addresses contained within the leaked files appear to belong to employees who are currently active. This suggests the breach may have involved recent and relevant internal data rather than historic documents.
As far as this operation is concerned, the threat actor is associated with the Hellcat Ransomware group, a collective infamous for repeatedly targeting Jira servers with its malware.
Hellcat has been connected to several high-profile breaches which have affected major global companies. Affinitiv, a marketing technology company, Jaguar Land Rover, Orange Group, Schneider Electric, as well as Ascom, a Swiss company that provides telecommunication and workflow solutions, iareof the companies that have claimed to have been affected by this hack.
In addition, the group's consistent focus on exploiting Jira platforms indicates that they have developed a strategic, specialised approach to identifying and exploiting specific system misconfigurations in enterprise environments. Analysts warn that this operational pattern is indicative of a larger, industry-wide risk that should be addressed urgently by reevaluating the security configurations and access controls within the platform.
Even though there are still a few details about the hack that led to the Telefónica breach, the incident serves as a sharp reminder of the evolving threat landscape that even the most fortified organisations are facing in today's digital ecosystem, where perimeter defences alone are not sufficient to protect themselves.
The cybersecurity environment must be regarded holistically and with zero trust—a strategy that emphasises continuous monitoring, proactive threat intelligence, and robust internal controls. As a key entry point for attackers, human error remains one of the leading factors preventing them from attacking, so companies must cultivate a culture of cybersecurity awareness among employees in addition to technical safeguards.
Also, the fact that the breach recurred through an already exploited vector underscores the importance of rigorous post-incident remediation, configuration audits, and patch management to prevent recurrences of the attack. Telefónica’s experience is a cautionary case study for industry peers and stakeholders on the consequences of underestimating latent system vulnerabilities as well as the speed with which attackers can re-engage with the system.
Nevertheless, to minimise systemic risk and maintain public trust in an era of escalating digital exposure, the telecom sector will need to enhance transparency, swift incident disclosure, and collaboration to fight cyberattacks across the sector.
.jpg "Social Engineering Identified as Catalyst for M&S Ransomware Breach")
.jpg)
.jpg "Telefónica Investigates Claims of Major Data Breach by Cybercriminal")
.jpg)