What Do We Know So Far?
Cyber intelligence monitoring has detected a post on the clandestine forum DarkForums attributed to the actor LoikLeads, offering what is claimed to be a database from Peusa, a Spanish energy sector company. The post, marked as "CTI ALERT", describes a theft of financial data, personally identifiable information (PII), and a customer base allegedly up for sale.
The incident's status is UNCONFIRMED, and so far there has been no official statement from Peusa or Spanish authorities. However, the publication has raised concerns in the sector, given that Peusa operates in a critical area like energy.
"The sale of customer databases on dark web forums is a growing practice affecting companies of all sizes," warn cybersecurity experts.
What Is Peusa?
Peusa (Productora Eléctrica Uruguaya S.A.) is a company with operations in Spain and Uruguay, dedicated to the generation and commercialization of electrical energy. It is part of the Grupo Peusa, with activities in both countries. Its profile makes it an attractive target for cybercriminals seeking customer data or sensitive information from the energy sector.
What Does a PII and Financial Data Leak Imply?
Personally identifiable information (PII) includes data such as names, addresses, national ID numbers, emails, and phone numbers. When combined with financial data (account numbers, cards, or payment history), the risk of fraud, phishing, and identity theft increases significantly for affected customers.
Experts recommend that users of energy services:
- Change passwords for their online accounts.
- Monitor bank transactions and unusual consumption patterns.
- Be wary of emails or calls requesting personal data.
- Enable two-factor authentication (2FA).
Context: Cybersecurity in the Energy Sector
The energy sector is one of the most attacked worldwide. According to reports from ENISA (the EU Agency for Cybersecurity), attacks on critical infrastructure increased by 24% in 2025 compared to the previous year. Spain, in particular, has been the target of multiple intrusion attempts in recent years, both by criminal actors and state-linked groups.
This type of incident underscores the need for companies to strengthen their security protocols and for users to take proactive measures to protect their information.
Recommendations for Peusa Customers
While awaiting official confirmation, Peusa customers are advised to:
- Regularly review their bills and consumption.
- Contact Peusa through official channels if they detect irregularities.
- Stay informed through reliable sources.
The company has not yet issued a public statement. This outlet will continue monitoring the situation and update the information as new developments arise.
Source: cyber intelligence monitoring on dark web forums. Status: unconfirmed.