Spain arrests – Spain’s National Police arrested a person accused of leaking sensitive personal data tied to major state bodies, including INCIBE. The case began after authorities detected mass dissemination, and culminated with an arrest on May 27, after a home raid and seiz
For Spain’s National Police, the moment was immediate: once authorities detected the mass dissemination of leaked personal data, they moved toward an urgent operation aimed at stopping a threat to the people exposed and the institutions involved.
Last Wednesday, May 27, that push ended with the arrest of the person suspected of leaking sensitive information. The police also searched the individual’s home and seized computers and other electronic devices that could contain technical forensic evidence.
The case centers on what authorities describe as a massive leak of personal data tied to members of various key state organizations. including the National Cybersecurity Institute (INCIBE). Police say the published information carried national security risks because of the people exposed. They specify that the data came from the State Attorney General’s Office. INCIBE. the National Police. the Civil Guard. and the National Security Council—critical entities in the country.
The investigation was overseen by Madrid Investigative Court No. 22 and began after authorities detected mass dissemination of this data, which created what the police describe as an immediate risk to both the affected individuals’ security and the integrity of the institutions.
Police say the operation was launched because of the seriousness of the situation, culminating in the May 27 arrest and home search. The police press release does not say whether the same person was responsible for breaching the portals.
INCIBE’s prior account adds another layer to the story. In February, the institute posted about an ongoing doxing operation, stating there was no direct compromise of its systems. Instead, INCIBE said the activity involved a targeted collection and publication of data impacting key entities and their employees.
Authorities also point to the kinds of sources that may have fed the exposed dataset. Potential sources, as described, include older breaches, credential dumps, and OSINT tools. The data, police say, was then aggregated and correlated to create curated collections.
Some leaked records reportedly contained outdated information, including names of employees who had left INCIBE years earlier.
The threat group tied to the leak was reportedly ‘Police-ESP-Doxed. ’ distributed in one of BreachForum’s iterations available at the time. The wider shadow of the same ecosystem is hard to ignore: later. in March. personal data of hundreds of Spanish judges and prosecutors was published on Doxbin. including full names. DNI numbers. personal mobile phone numbers. and professional email addresses.
Police say they are currently examining the seized devices for evidence of additional participants. If that forensic work turns up more people involved, more arrests may follow.
Spain National Police doxing sensitive data leak INCIBE Madrid Investigative Court No. 22 BreachForum Doxbin Police-ESP-Doxed cybersecurity personal data forensic evidence
So they caught the doxer… but did they also find who leaked it first? Seems like always missing that part.
This is why I don’t trust “national security” anything. They say it’s not their system but somehow the data ends up everywhere.
Wait I thought doxing was just like posting random phone numbers, not “portals”?? Sounds like they’re blaming one person but could be inside the State Attorney General’s Office…
Madrid raid, computers seized, arrest May 27—ok but this reads like a cybercrime movie. If it came from those government bodies, why wasn’t it fixed earlier? Also the article says INCIBE wasn’t compromised in Feb, which feels like a contradiction to me.