Public cyber incident analysis · 2024
Santander: protecting trust when a third party holds the data
Affected data, service continuity and the provenance of information. An analysis that keeps the bank’s disclosures distinct from figures circulated by attackers.
Analysis of a public incident, not a CyberUP client reference. Disclosures, documents and operational interpretation.
At a glance
Scope matters more than a headline number
Scope of the US notification
Individuals listed in the Santander Holdings U.S.A. filing; not a global total. [2]
Figures and dates come from the cited sources. They are not results from a CyberUP exercise.
The documented record
Facts and scope.
The bank’s account
Santander identified customers in Spain, Chile and Uruguay, all current Group employees and some former employees as affected. It stated that the database did not contain transactional data or credentials that would enable account transactions. It reported blocking compromised access, adding fraud controls and contacting those affected. [1]
A local notification does not define the global incident
The Maine register contains a Santander Holdings U.S.A. notification listing 12,786 individuals and its own relevant dates. That number describes the filing’s scope; it must not be extended to all Group customers and employees. The local notification does not, on its own, resolve the incident’s overall scope. [2]
Key dates
The documented timeline.
Communications need the same precision as the data
We propose separating three questions at the start of an exercise: which information is affected, which activities remain available and what people are being asked to do. Conflating them can lead to either alarmism or overbroad reassurance. The objective is a useful message, even before the full picture is known.
The exercise should bring together supplier management, Security, data owners, Legal, HR and communications. They do not need to be activated in an invented sequence. The programme should identify which decisions need their input and who maintains a shared, current account of the information.
The same discipline applies to numbers. A count relating to one entity or notification must not become the total for the incident. We suggest recording the population, source and date, and distinguishing a company disclosure from an external claim. The exercise can deliberately change the scope to observe how the team updates its message.
For workforce readiness, the analysis can inform scenarios involving suspicious requests and identity checks. This is a potential exercise topic, not evidence that a particular fraud attempt followed this incident. Staff need to know how to report concerns, not be tasked with investigating them independently.
From incident analysis to readiness
Three questions to test.
Exercise ideas for your organisation. They do not describe work carried out by CyberUP for the organisation discussed.
Who reconciles information from the supplier?
Appoint an owner and maintain a shared account of the scope. Record what is confirmed, what the statement excludes and what still needs to be checked.
Is the message useful without making absolute claims?
Prepare guidance for customers and staff that distinguishes operations from data exposure. Do not turn “no evidence” into “impossible”.
Is the affected population described correctly?
Check that every figure remains linked to its entity, period and population, including in infographics and headlines.
Source record
Sources and further reading.
Source dates and the period covered are distinct from this page’s source-review date. CyberUP interpretations are labelled as such. External sources do not imply endorsement or a commercial relationship.
- Banco Santander · 14 May 2024
Statement (opens in a new tab)Primary company statement. The bank’s account of scope, affected people, excluded data and operational status. - Maine Attorney General · Santander Holdings U.S.A. filing · Notifications dated 18 June 2024
Data Breach Notice — Santander Holdings U.S.A., Inc. (opens in a new tab)Company notification in a public register. The US filing’s scope, not a global count for the Group.