What you should know about the cybersecurity incident at Resa: calm, action, and prevention

2025-05-02

We live in a hyperconnected era where protecting personal information is more important than ever. In this context, RESA recently detected a security incident resulting from unauthorized access to one of our systems. We want to share this with you clearly, calmly, and—above all—usefully, because information is the best tool for preventing future threats.

What exactly happened?

In March, we identified that an unauthorized third party was able to bypass the security measures of one of our IT systems and gained illegitimate access to certain personal data of our users. The compromised information varied depending on the case and was limited to identifying and contact details. In some instances, it included ID numbers and bank account numbers (IBAN).

Most importantly: No data that would allow payments or transfers was compromised. Nonetheless, we are fully aware that any unauthorized use of personal data requires a prompt, transparent, and responsible response. And that is exactly what we delivered.

What does this mean for you as a user?

Although the compromised data does not allow financial transactions by itself, it could be used for phishing attempts, similar scams, or other unauthorized uses. That’s why we believe this is a good moment to review some essential digital security practices we can all apply:

3 Tips to Protect Your Personal Data:

Be cautious of the unexpected: If you receive an email, SMS, or message on social media requesting personal information, don’t respond or click on suspicious links. Be especially wary of phone calls asking for personal data. Always verify the sender.
Don’t download files from unknown sources: This is one of the most common ways malicious software is spread.
Change your passwords regularly: Use secure and unique combinations for each platform. Consider using a password manager if you handle multiple credentials.

Calm, Learning, and Ongoing Improvement

We want to deliver a clear message: the situation is under control, and there is no reason for alarm. At RESA, we continue to work tirelessly to further strengthen our systems, processes, and organizational culture around privacy and cybersecurity.

This is not just an incident that has been resolved—it is also an opportunity to learn and reinforce our digital safety together. Because when we protect our data, we also protect our peace of mind.

If you have any questions or would like to know more about how we protect your data, you can contact our Data Protection Officer, Áudea Seguridad de la Información S.L., at: privacy@resa.es. Our commitment to transparency, data protection, and continuous improvement is unwavering.