The article describes a doxing operation targeting Spanish state organizations, where an individual was arrested for allegedly disseminating sensitive personal data. The data was likely aggregated from past breaches and credential dumps rather than a direct system compromise, posing a significant national security risk by exposing personnel in critical entities. Forensic analysis of seized devices is ongoing and may lead to further arrests.
Government security Spanish police arrest individual in connection with data leak from state organizations June 2, 2026 Share By SC Staff (Adobe Stock) Coverage from Bleeping Computer indicates that the Spanish National Police has arrested an individual suspected of leaking sensitive personal data belonging to members of key state organizations, including the National Cybersecurity Institute (INCIBE). The leak posed significant national security risks due to the exposure of individuals within critical government entities. The arrested individual is accused of disseminating data from entities such as the State Attorney General's Office, INCIBE, the National Police, the Civil Guard, and the National Security Council. Authorities seized electronic devices during a residence search, which are being analyzed for forensic evidence. The investigation began after the mass dissemination of data was detected, creating an immediate risk to the affected individuals and institutions. While the police have not confirmed if the arrested person was responsible for breaching the portals, INCIBE previously stated they were not directly compromised but were targeted in a doxing operation. Potential data sources include past breaches and credential dumps. The threat group "Police-ESP-Doxed" has been linked to similar leaks. The ongoing examination of seized devices may lead to further arrests. Source: Bleeping Computer SC Staff Related Government security U.S. military personnel targeted using commercial location data SC Staff May 29, 2026 The U.S. Central Command acknowledged in a letter that hostile actors are purchasing commercial location data to track American servicemembers. Vulnerability Management Drupal bug added to CISA list of known exploited vulnerabilities Steve Zurier May 26, 2026 Drupal SQL injection flaw CVE-2026-9082 added to CISA KEV as active attacks target sites. Government security Belarus-linked Ghostwriter group targets Ukraine using Prometheus learning platform lures SC Staff May 22, 2026 Ghostwriter, also known as UAC-0057 and UNC1151, employs a multi-stage attack. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe You can skip this ad in 5 seconds