**Spanish Teen Arrested for Stealing and Selling 64 Million Personal Records**
Spanish authorities have detained a 19-year-old man in Igualada, northeastern Spain, for allegedly stealing and selling approximately 64 million personal data records from nine companies. The suspect, arrested last week, is accused of infiltrating corporate systems to extract sensitive information—including national identity numbers (DNI), home addresses, phone numbers, email addresses, and IBAN bank codes—before offering the data for sale on hacker forums. The full extent of affected individuals remains unclear.
The investigation, launched in June after authorities detected the data theft, led police to identify the suspect through six online accounts and five pseudonyms used to advertise the stolen databases. During a search, officers seized electronic devices and hardware-based cryptocurrency wallets, while also freezing a crypto wallet linked to the proceeds of the sales.
In a separate case, Polish police arrested three Ukrainian men earlier this week after discovering hacking equipment—including SIM cards, antennas, hard drives, and a device used to detect surveillance tools—in their vehicle. The men, who claimed to be IT specialists, were unable to justify their possession of the gear. They now face charges of fraud, computer fraud, and possessing tools intended for cybercrime or attacks on systems critical to national defense.
Source: https://therecord.media/spain-arrests-teen-suspect-data-theft-and-sale
National Missing and Unidentified Persons System (NamUs) cybersecurity rating report: https://www.rankiteo.com/company/namusinfo
"id": "NAM1765383783",
"linkid": "namusinfo",
"type": "Breach",
"date": "12/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'location': 'Spain', 'type': 'Company'}],
'attack_vector': 'Unauthorized Access',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '64 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['National identity numbers (DNI)',
'Home addresses',
'Phone numbers',
'Email addresses',
'IBAN bank codes']},
'date_detected': '2023-06',
'date_publicly_disclosed': '2023-10-24',
'description': 'A 19-year-old man in northeastern Spain was arrested for '
'allegedly stealing and selling approximately 64 million '
'personal data records from nine companies. The stolen data '
'included national identity numbers (DNI), home addresses, '
'phone numbers, email addresses, and IBAN bank codes, which '
'were sold on hacker forums.',
'impact': {'data_compromised': '64 million records',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'investigation_status': 'Ongoing',
'motivation': 'Financial Gain',
'references': [{'date_accessed': '2023-10-24',
'source': 'National Police of Spain'}],
'regulatory_compliance': {'regulations_violated': ['GDPR']},
'response': {'containment_measures': 'Arrest of suspect, seizure of '
'electronic devices and cryptocurrency '
'wallets',
'law_enforcement_notified': 'Yes'},
'threat_actor': 'Individual (19-year-old male)',
'title': 'Spanish Suspect Arrested for Stealing and Selling 64 Million '
'Personal Data Records',
'type': 'Data Breach'}