Spanish Public-Sector Breach Claims Trigger System Shutdowns and Data-Sale Posts

Spain’s Ministry of Science, Innovation and Universities partially shut down its “electronic headquarters,” suspending administrative procedures and disrupting citizen- and company-facing services after reporting a “technical incident” under assessment. A threat actor using the alias GordonFreeman claimed responsibility, posted alleged proof-of-breach samples on underground forums, and offered purportedly stolen data for sale; the samples were described as including personal records, email addresses, enrollment applications, and screenshots of official documents, with the actor alleging exploitation of a critical IDOR flaw to obtain valid credentials.

Separately, Spain’s Ministry of Finance (Ministerio de Hacienda y Función Pública) faced an unverified data-breach claim from a threat actor calling themselves HaciendaSec, who advertised alleged access to data on ~47.3 million citizens (including claimed tax identifiers and banking details) on a dark web forum. The Ministry, working with Spain’s National Cryptologic Centre (CCN), stated it found no evidence of compromise or exfiltration in internal systems as of the initial investigation, and authorities are assessing whether the dataset is authentic, recycled, or sourced elsewhere; this incident is distinct from an unrelated outage at Rome’s La Sapienza university following a suspected ransomware attack.