Loading story…
Spain’s Ministry of Science, Innovation and Universities partially shut down its “electronic headquarters,” suspending administrative procedures and disrupting citizen- and company-facing services after reporting a “technical incident” under assessment. A threat actor using the alias GordonFreeman claimed responsibility, posted alleged proof-of-breach samples on underground forums, and offered purportedly stolen data for sale; the samples were described as including personal records, email addresses, enrollment applications, and screenshots of official documents, with the actor alleging exploitation of a critical IDOR flaw to obtain valid credentials.
Separately, Spain’s Ministry of Finance (Ministerio de Hacienda y Función Pública) faced an unverified data-breach claim from a threat actor calling themselves HaciendaSec, who advertised alleged access to data on ~47.3 million citizens (including claimed tax identifiers and banking details) on a dark web forum. The Ministry, working with Spain’s National Cryptologic Centre (CCN), stated it found no evidence of compromise or exfiltration in internal systems as of the initial investigation, and authorities are assessing whether the dataset is authentic, recycled, or sourced elsewhere; this incident is distinct from an unrelated outage at Rome’s La Sapienza university following a suspected ransomware attack.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On February 5, 2026, Spain's Ministry of Science, Innovation and Universities announced a partial shutdown of IT systems, temporarily closing parts of its electronic headquarters and suspending administrative procedures due to a technical incident. A ministry spokesperson confirmed to Spanish media that the disruption was related to a cyberattack, and the ministry said deadlines for affected procedures would be extended.
A threat actor using the alias "GordonFreeman" claimed responsibility for a cyberattack on Spain's Ministry of Science, Innovation and Universities and offered allegedly stolen ministry data for sale. The actor also posted sample data and said the intrusion was achieved through a critical IDOR vulnerability that led to credentials and full administrative access.
After the breach claim surfaced, the Ministry of Finance said it found no evidence of unauthorized access or data exfiltration from its internal systems. The ministry, together with Spain's National Cryptologic Centre (CCN), began a forensic investigation to determine whether the data was authentic, recycled, or sourced from a third party.
On February 3, 2026, a threat actor using the name "HaciendaSec" advertised an alleged dataset for sale on a dark web forum, claiming it was stolen from Spain's Ministerio de Hacienda y Función Pública. The actor said the data covered about 47.3 million citizens and included tax identifiers, contact details, and bank information, though the claim remained unverified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police arrested a man in Granada for allegedly publishing sensitive personal data belonging to personnel from several high-profile state institutions, including the National Police, Civil Guard, Attorney General’s Office, National Security Council, and Spain’s National Cybersecurity Institute (**INCIBE**). Authorities said the information was disseminated across multiple online platforms, creating immediate risks to both the affected individuals and the operational security of the agencies involved. The investigation, led by Madrid’s Court of Instruction No. 22, culminated in the suspect’s arrest on May 27 and a search of his home, where police seized computers and other electronic devices for forensic analysis. Officials described the breach as a large-scale exposure that could facilitate harassment, threats, extortion, or coordinated targeting of government workers, and said the inquiry remains active to determine the full scope of the leak and whether additional participants were involved.
Jun 29, 2026
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
Ukraine’s National Bank (NBU) took its **collectible coin/numismatic online store** offline after a cyberattack against a supporting **contractor** potentially exposed customer registration data (names, phone numbers, emails, and delivery addresses). The NBU said **core banking systems were not affected** and **no payment card or banking data** was compromised, but warned the exposed PII could be leveraged for **phishing** and other follow-on fraud; the incident was described as consistent with a **supply-chain** intrusion path. In France, authorities disclosed illegal access to a portion of the **National Bank Accounts File (FICOBA)**—a government database used for tax, customs, and law-enforcement purposes—after an attacker **impersonated a civil servant** and used valid credentials to query data. Officials said up to **1.2 million accounts** may have been impacted, with exposed fields potentially including account numbers, names, addresses, and in some cases tax identifiers; **DGFiP**, supported by **ANSSI**, is investigating and notifying affected individuals while banks were alerted to heighten fraud/phishing monitoring. Separately, **Safran Group** denied being cyberattacked, stating that a leaked dataset containing “non-strategic” order/customer details was **inadvertently exposed via a third-party provider**, with external analysis suggesting the compromise occurred elsewhere in the supply chain rather than within Safran’s own systems.
Jun 29, 2026