Databases remain one of the primary targets for cyberattacks. They hold an organization’s most sensitive information: patient data, formulas, production histories, financial information, or customer personal data. In the digital economy, information is power, and protecting it is no longer optional. 

 In this article, we explore the most common incidents of recent years and how database protection evolved in 2025, helping you reduce risks and make better cybersecurity decisions in 2026. 

Recent security incidents 

Hundreds of ransomware and data leak incidents targeting corporate databases directly or indirectly are recorded every year, resulting in economic, regulatory, and reputational impacts that are difficult to manage. Recently, major cyberattacks worth summarizing have been detected: 

  • Snowflake (2024)
     In 2024, an attack targeting customer environments on the Snowflake cloud data platform was revealed. It affected over a hundred organizations—including Ticketmaster, AT&T, and Santander—and exposed sensitive information through the use of stolen credentials and accounts without multi-factor authentication. (Sources: CSA, Wired y The Hacker News)
  • Banco Santander (2024)
    That same year, Banco Santander acknowledged unauthorized access to a database hosted by an external provider, which contained customer and employee data across several countries. This event forced the entity to strengthen controls and publicly notify the incident.  (Source: Santander)
  • El Corte Inglés (2025)
    In March 2025, El Corte Inglés reported a cyberattack on one of its external providers, allowing access to personal data and purchase card numbers of certain customers. This serves as a reminder that even large companies with significant tech investments are vulnerable when the supply chain fails. (Fuente: Cinco Días)

With the enforcement of the NIS 2 Directive in the European Union, many companies—including SME suppliers in critical sectors—face new cybersecurity obligations, strict notification deadlines, and relevant penalties for non-compliance. In this context, having a coherent, updated database security strategy aligned with regulations is key to reducing risks and ensuring business continuity. 

The Vital Importance of Database Security

The sensitive information of most companies is stored in database management systems: SQL Server, Oracle, MySQL, PostgreSQL, cloud databases (Snowflake, Azure SQL, AWS RDS, BigQuery, etc.). Attackers look specifically for these repositories because they contain everything needed to extort, steal intellectual property, or commit fraud.

To achieve this, they mainly exploit:

  • Weak or reused passwords
  • Insecure or default configurations
  • Lack of patches and updates
  • Absence of encryption or network segmentation
  • Errors in applications accessing the database (SQL injections, validation flaws, etc.)

For years, the strategy relied on building a "castle" around systems: firewalls, IDS/IPS, antivirus. But in 2025, the perimeter became blurred: we work remotely, use SaaS, multi-cloud, and external providers who also handle our data.

Recent cases like Snowflake, Santander, or El Corte Inglés show that protecting the internal network is no longer enough: we must assume data can be scattered across multiple platforms and third parties.

Therefore, database security must shift from "protecting the moat" to protecting data and identities wherever they are, under a Zero Trust approach.

New database risks in 2025

Beyond classic vulnerabilities, today we must keep in mind:

1. Misconfigured cloud and multi-cloud environments

Many organizations moved their databases to the cloud for flexibility and scalability. However, incorrect configurations, lack of MFA (multi-factor authentication), or exposed access keys in code repositories can open the door to massive data leaks.

The Snowflake case demonstrated how stolen credentials from malware and environments lacking multi-factor authentication or additional controls allow an attacker to pivot across multiple databases hosted on the same platform, affecting dozens or hundreds of organizations at once.

It is common for a single organization to have data scattered across multiple providers (IaaS, PaaS, SaaS) and regions, complicating data governance and protection without unified policies and tools.

2. Supply Chain Attacks 

More and more incidents reach companies through their providers. A security flaw in a third party with access to our databases or systems can become the "weak link" opening the door to attackers.

The 2024 Santander incident (where an external provider's database was accessed without authorization) and the 2025 El Corte Inglés attack are clear examples of how a third party can become the entry point to critical information.

This affects integrators, software providers, hosting services, cloud services, or companies processing data on our behalf.

3. Identity Theft and Privileged Access

Attackers steal credentials via phishing, malware, or infostealers and use them to enter as legitimate users, sometimes with elevated privileges.

Without multi-factor authentication, periodic permission reviews, or activity monitoring, an attack can go unnoticed for weeks and result in leaks, destruction, or encryption of large volumes of data. 

4. AI: A Tool to Defend... and to Attack!

Artificial intelligence is already used to detect anomalies and suspicious patterns in real time, both in networks and in databases. Machine learning models help identify atypical behavior from users, applications, or services accessing critical information.

However, a new attack surface has emerged: generative AI models and their integrations with applications and databases. Prompt injection attacks manipulate model instructions to extract data or execute unauthorized actions, leading to specific warnings from various cybersecurity agencies.

Most frequent (and still active) database vulnerabilities

Even if the context has changed, many classic weaknesses remain entry points in 2025:

Weak passwords or missing MFA

Users with simple or reused passwords across different systems, or database access without multi-factor authentication, make life easy for attackers with leaked credentials. 

Excessive user privileges 

Application accounts and human users with read, write, and admin permissions when they only need to query data. Any compromise of these accounts can lead to deletion, encryption (ransomware), or massive exfiltration. 

Unnecessary features enabled 

Modules, services, and default packages installed on the database engine that aren't used, aren't patched, and end up as open doors to known vulnerabilities. 

Outdated and unencrypted databases:

Failing to apply critical patches on time leaves vulnerabilities open to automated attacks on an industrial scale. Unencrypted databases allow unauthorized access to read plain text data. 

SQL Injections and Insufficient Validation:

SQL injection remains one of the most frequent attacks against web apps and APIs accessing databases. Lack of input validation, unparameterized dynamic queries, and missing security testing make it a classic vector that still works. 

Recommendations to protect a database in 2026

Building on traditional best practices, we update them with a vision aligned with Zero Trust, cloud, and NIS2 to start 2026 on the right foot:

1. Identify vulnerabilities and exposure surface

  • Inventory all databases (on-premise, cloud, SaaS, lab environments).
  • Analyze configuration, patches, encryption, roles, and permissions.
  • Use specific database vulnerability management tools (specialized scanners, configuration reviewers, etc.) that automate tasks and generate clear risk reports.

The goal is to move from "I think it's secure" to "I know exactly where my weaknesses are".

2. Adopt zero trust principles for data access 

  • Aplicar principio de mínimo privilegio: cada usuario y cada aplicación solo ve y hace lo estrictamente necesario.
  • Implementar MFA obligatorio para accesos administrativos y a bases de datos críticas.
  • Segmentar la red y/o utilizar microsegmentación para evitar movimientos laterales en caso de compromiso.
  • Revisar periódicamente los permisos y desactivar cuentas huérfanas o no utilizadas.

3. Keep Software Always Updated (and Simplify Management) 

  • Establish a patch management process for database engines, operating systems, and access libraries (drivers, frameworks, etc.).
  • Where immediate updates aren't possible (due to regulatory or validation requirements), consider virtual patching or compensating controls.
  • Prioritize simplicity when managing: fewer products, better integrated, with centralized visibility.

4. Monitorizar y auditar la actividad de la base de datos

  • Implement Database Activity Monitoring (DAM) solutions or cloud equivalents to log access, sensitive queries, and critical changes.
  • Generate alerts for anomalous behavior:
    • Off-hours access.
    • Reading large volumes of sensitive data.
    • Queries executed by accounts that rarely do so.
  • Integrate these logs with SIEM or SOC tools for centralized correlation and response.

5. Encryption and Data Protection

  • Encrypt data at rest (in the database and backups).
  • Encrypt data in transit between applications, services, and users.
  • Securely manage keys and secrets (HSM, secrets managers, periodic rotation, etc.).

6. Continuous Regulatory Compliance (GDPR, NIS2, and Sectoral) 

  • Define a control framework aligned with GDPR, NIS2, and sector-specific regulations (pharma, healthcare, industrial, etc.).
  • Automate audit evidence, access reports, and change traceability as much as possible.
  • Prepare clear procedures for incident notification within required regulatory deadlines

7. Awareness and governance

Technology without governance and without a security culture falls short:

  • Train IT, development, and business teams in database security best practices.
  • Establish policies for passwords, MFA, and the use of privileged accounts.
  • Include database security in global cybersecurity governance and risk committees.

Improve your security strategy with Ambit Iberia

At Ambit Iberia, we help companies in regulated and critical sectors protect their most sensitive data, both in on-premise environments and in the cloud. We guide our clients throughout the entire lifecycle:

  • Risk assessment and diagnosis of your database status.
  • Design of a security strategy aligned with NIS2, GDPR, and sector-specific regulations.
  • Implementation of solutions for monitoring, vulnerability management, encryption, and access control.
  • Continuous support to maintain and improve security levels over time.

If you want to review the security of your databases or adapt to new regulatory obligations, we can help you define the right strategy for your organization. Contact us.