A threat actor advertising on a criminal forum claims to have stolen, and in some accounts destroyed, the records of every pensioner in Spain, taken from the Instituto Nacional de la Seguridad Social (INSS), the agency that administers state pensions, sick leave, and parental benefits. Record counts reported so far range from "over 3 million" (Cybernews) to a precise figure of 3,184,288 quoted by Undercode News citing the Dark Web Intelligence monitoring account. INSS has not confirmed a breach, and as of publication no Spanish government body, national CERT, or regulator has issued a statement. Every substantive detail below originates with the attacker or with third-party monitoring of the attacker's post. Treat it as an unverified extortion claim with a plausible core, not as a confirmed incident.
What Happened
A post on what Cybernews describes as a well-known hacker forum offered a dataset attributed to INSS for sale, accompanied by samples intended to prove authenticity. The seller frames the sale as the second stage of a failed extortion: they say they contacted the affected organisations demanding payment to suppress the data and, in their words, "not receiving further response, I came here to sell this breach from Instituto Nacional de la Seguridad Social, which includes ALL pensioners in Spain." Undercode News, drawing on the same Dark Web Intelligence reporting, describes the same sequence of a failed extortion attempt preceding the listing.
The claim that the source data was wiped comes from the framing of the Cybernews report and is not independently substantiated in the source material available here. No source documents a service outage, delayed benefit payment, or recovery operation at INSS, which is what a genuine destructive event at that scale would normally produce. Accounts differ on this point and the wipe should be treated as the weakest element of the claim.
There is also a second, thinner data point in circulation. Undercode News published a separate piece on 28 July referencing a Dark Web Intelligence post about an alleged breach "connected to Spain" that named only a domain, with no organisation, volume, or data types specified. Whether that post refers to the same incident is not established by any source, and the outlet itself notes it was too vague to assess.
Cybernews reports that its research team reviewed the samples and assessed that the data appears to belong to real people rather than being fabricated, but could not determine how recent the data is. That distinction matters: recycled or aged datasets are routinely relabelled as fresh government breaches to inflate their price.
What Was Taken
The seller describes a primary dataset in JSON format, with additional material held in PDF and image formats. Undercode News reports the advertised contents as personal identification details, financial information, and family-related records tied to pension beneficiaries. Cybernews does not enumerate field-level contents beyond the format and the pensioner scope.
If the dataset is what it claims to be, the sensitivity profile is severe and largely irreversible. Pension records combine identity data that cannot be rotated, national identity document numbers, dates of birth, contact details, with financial and dependency information. Undercode makes the point directly: unlike a password, an identity cannot be reset after exposure.
The scale claim deserves scrutiny of its own. Spain has substantially more than 3.1 million pension recipients, so a dataset of roughly 3.18 million records is not consistent with a claim to hold "ALL pensioners in Spain." Either the seller is overstating coverage, or the dataset represents a subset such as a single benefit type, region, or system export. That internal inconsistency is one of the strongest reasons for caution.
Why It Matters
Spain has absorbed a sustained run of claimed and confirmed data incidents through 2026, and the pattern around each of them is more instructive than any single claim.
The Record reports that Spanish National Police arrested a suspect in Granada for publishing personal data belonging to officials from the National Police, Civil Guard, Attorney General's Office, National Security Council, and INCIBE, with devices seized and forensic analysis ongoing. That arrest followed the detention of a 19-year-old in northeastern Spain accused of stealing and selling roughly 64 million personal records taken from nine companies. Authorities have not said whether the cases are linked, and neither has been connected to the INSS claim.
Denials are equally part of the pattern. Roams reports that an actor using the alias GordonFreeman claimed 1,953,721 records from the Ministry of Foreign Affairs, and that the Ministry flatly denied it, stating that neither headquarters nor embassies and consulates had suffered any hack. The same actor had claimed an intrusion at the Ministry of Science and Innovation in February 2026. Meanwhile a genuine and technically mundane failure did occur elsewhere: APD Noticies reports that an actor using the alias misere extracted 504 files totalling 182 MB from the Royal Spanish Football Federation's coaching academy platform, including double-sided DNI scans, invoices, and videos, and was able to enumerate 113,681 user identifiers, all through an unauthenticated Firebase real-time database and an open storage container.
For defenders, the operational lesson is that the government-data-for-sale market in Spain is active enough that both real breaches and inflated claims are now routine, and that pensioner-targeted phishing will follow this listing regardless of whether the underlying data is genuine. Cybernews specifically highlights the elevated susceptibility of older recipients to convincing benefit-themed lures.
A separate strand of scrutiny concerns the infrastructure itself. El País reports that the Gerencia de Informática de la Seguridad Social (GISS) has tendered a contract with an estimated value of 160.9 million euros covering support, operation, and maintenance of the databases underpinning employment and pension data, with the work continuing to run on Huawei storage systems. Vozpópuli reports the same procurement with a 81.1 million euro two-year contract value against an estimated total exceeding 160 million euros, published by GISS on 10 June, and identifies the specific hardware as Huawei OceanStor Dorado 8000, OceanStor Pacific 9520, and OceanStor Dorado 5000 arrays. El País cites BOE publication on 16 June and quotes sector experts describing the arrangement as vendor lock-in, with the contract requiring third-party bidders such as Telefónica, Indra, or Minsait to field staff certified on Huawei equipment. No source connects this infrastructure to the alleged breach, and nothing in the reporting suggests the storage platform was the vector. It is relevant only as context on the concentration and supportability of the systems holding the data.
The Attack Technique
The only technical claim about the intrusion comes from the attacker. Cybernews reports the seller named TerciosRAT as the exfiltration tool, a remote access trojan rather than ransomware, meaning the stated objective was persistent covert control and bulk data theft rather than encryption. No independent analysis of TerciosRAT, no indicators of compromise, no initial access vector, and no dwell-time estimate appear in any available source. Undercode News states plainly that there is no independent confirmation of a breach at INSS and that the authenticity, age, and completeness of the dataset remain unknown.
The named tooling is worth logging but not worth over-weighting. Attackers routinely attach a branded malware name to a listing to signal capability, and a RAT claim is not verifiable from a data sample alone. For comparison, the two Spanish incidents with the most concrete technical detail in this reporting set required no malware at all: Roams reports that Hackmanac attributed the Foreign Ministry claim to an IDOR flaw, where changing an identifier in a request returns records that should be restricted, and APD Noticies attributes the RFEF exposure to Firebase deployed with no authentication rules and unrestricted API keys. Neither was independently confirmed as to depth of access, and in the RFEF case the attacker also warned publicly about the exposed keys.
What Organizations Should Do
- Treat the claim as an active phishing trigger regardless of verification status. Benefit and pension agencies should push pre-emptive warnings to recipients now, using channels those recipients already trust, and state clearly that the agency will never request identity documents or banking details by email, SMS, or phone callback.
- Hunt for RAT-consistent activity in benefit-processing environments. Look for long-lived outbound sessions from database and application servers, anomalous bulk JSON or PDF export jobs, service accounts reading far outside their normal record volumes, and archive staging in temp directories. Set the lookback window to at least twelve months, since the age of the data is unknown.
- Audit for the unglamorous failures that actually produce these datasets. Enumerate every internet-facing application for IDOR-class flaws by testing whether object identifiers can be incremented to return other users' records, and sweep cloud backends for unauthenticated databases, open storage containers, and client-side API keys without restrictions.
- Instrument bulk read detection, not just bulk write. A three million record export should be alertable at the database and API gateway layer with rate and volume thresholds per account, because in a RAT-style theft there is no encryption event to trip conventional ransomware controls.
- Verify the integrity and isolation of backups against a destructive-claim scenario. Confirm that offline or immutable copies of benefit records exist, that restoration has actually been rehearsed against the current storage platform, and that recovery does not depend on a single vendor's support pipeline.
- Assess third-party and vendor-managed access paths into critical data stores. Where operation and maintenance of core databases is outsourced to contractors, inventory those accounts, enforce just-in-time privilege and session recording, and confirm the contractual right to log and audit their activity.
- Preserve evidence and engage law enforcement early rather than negotiating. Spanish police have demonstrated capacity to identify and arrest actors in comparable cases, and paying a pre-leak extortion demand did not, in this instance, prevent the listing.
Sources: Data of all Spanish pensioners’ have been allegedly wipe out, hacke... | La Seguridad Social vuelve a confiar en Huawei para la gestión de s... | Spain arrests suspected hacker for publishing personal data of poli... | Millions of Spanish Pensioners at Risk? Dark Web Actor Claims Natio... | Spain Faces New Cybersecurity Concerns After Alleged Dark Web Data... | Moncloa blinda con 81 millones los sistemas Huawei de la Seguridad... | Un hacker asegura haber robado los datos de casi 2 millones de pers... | A failure in the RFEF exposes the DNI and videos of 113,681 users o...