Loading story…
Spanish National Police arrested a man in Granada for allegedly publishing sensitive personal data belonging to personnel from several high-profile state institutions, including the National Police, Civil Guard, Attorney General’s Office, National Security Council, and Spain’s National Cybersecurity Institute (INCIBE). Authorities said the information was disseminated across multiple online platforms, creating immediate risks to both the affected individuals and the operational security of the agencies involved.
The investigation, led by Madrid’s Court of Instruction No. 22, culminated in the suspect’s arrest on May 27 and a search of his home, where police seized computers and other electronic devices for forensic analysis. Officials described the breach as a large-scale exposure that could facilitate harassment, threats, extortion, or coordinated targeting of government workers, and said the inquiry remains active to determine the full scope of the leak and whether additional participants were involved.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Authorities said personal data tied to personnel from multiple sensitive Spanish state institutions, including police, prosecutors, national security, and cybersecurity bodies, was published across several online platforms. Investigators assessed the disclosure as creating serious security risks for affected officials and institutions.
On 2026-05-27, the Spanish National Police arrested a man in Granada suspected of leaking the sensitive personnel data. Officers searched his home and seized computers and other electronic devices for forensic analysis as part of an ongoing investigation led by Madrid’s Court of Instruction No. 22.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcetherecord.media
Open sourcepolicia.es
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spain’s **Ministry of Science, Innovation and Universities** partially shut down its “electronic headquarters,” suspending administrative procedures and disrupting citizen- and company-facing services after reporting a “technical incident” under assessment. A threat actor using the alias **GordonFreeman** claimed responsibility, posted alleged proof-of-breach samples on underground forums, and offered purportedly stolen data for sale; the samples were described as including personal records, email addresses, enrollment applications, and screenshots of official documents, with the actor alleging exploitation of a critical **IDOR** flaw to obtain valid credentials. Separately, Spain’s **Ministry of Finance (Ministerio de Hacienda y Función Pública)** faced an unverified data-breach claim from a threat actor calling themselves **HaciendaSec**, who advertised alleged access to data on **~47.3 million** citizens (including claimed tax identifiers and banking details) on a dark web forum. The Ministry, working with Spain’s **National Cryptologic Centre (CCN)**, stated it found **no evidence** of compromise or exfiltration in internal systems as of the initial investigation, and authorities are assessing whether the dataset is authentic, recycled, or sourced elsewhere; this incident is distinct from an unrelated outage at Rome’s **La Sapienza** university following a suspected ransomware attack.
Jun 29, 2026
Spain’s Audiencia Nacional (High Court) again closed its criminal investigation into the use of **NSO Group’s Pegasus** spyware against the mobile phones of senior Spanish government officials, citing a sustained lack of cooperation from **Israeli authorities**. Judge **José Luis Calama** said Israel failed to respond to multiple formal requests for assistance (letters rogatory), preventing attribution of the operation to specific individuals and violating international cooperation obligations and the “principle of good faith” between states. The probe began after Spain disclosed that the phones of Prime Minister **Pedro Sánchez** and Defence Minister **Margarita Robles** had been infected (Pegasus is described as **zero-click** spyware marketed for use by state agencies). Reporting also indicates the Interior and Agriculture ministers were targeted, and that Sánchez’s device was infected multiple times. The case had previously been shelved and later reopened after **French authorities** shared information tied to similar Pegasus intrusions affecting French officials and civil society, but the Spanish court ultimately concluded it could not proceed without Israeli cooperation; the earlier revelations also contributed to the dismissal of Spain’s intelligence chief and public acknowledgment of shortcomings at the national intelligence center (**CNI**).
Jun 29, 2026
Dutch police arrested a **40-year-old man from Ridderkerk** after he obtained **confidential police documents** due to a police error and then allegedly attempted to leverage possession of the files for something in return. According to police, the man was taken into custody on Thursday evening, his home was searched, and data storage devices were seized to recover the documents and prevent further dissemination; authorities also reported the incident as a **data breach** and said the investigation is ongoing. Reporting indicates the incident began when the man contacted police in connection with a separate matter and was sent a link intended for **uploading** images; instead, an officer mistakenly sent a **download link**, granting access to sensitive materials the recipient was not meant to see. While the man reportedly did not exploit a technical vulnerability or “break in” in a traditional sense, police said he was instructed to stop and delete the material and refused unless he “received something in return,” prompting the arrest and evidence seizure to contain the exposure.
Jun 29, 2026