Spain arrests doxer leaking sensitive data of govt employees
Spanish police arrested a suspect over a doxing campaign that exposed data on officials from key state bodies, including INCIBE.
Intelligence analysis by GPT-5.4 Mini
Spanish police say they arrested a person tied to a large doxing leak involving employees and members of key state institutions. The investigation is still open, and officers are checking seized devices for possible accomplices and more evidence.
A police team in Spain found someone they think was sharing private details about people who work in important government offices. It was not just gossip, because the data could help bad actors target those people.
Think of it like a thief making a big notebook full of house keys and home addresses. Even if the thief did not break into every house, the notebook itself can still cause harm.
The police took computers and other devices to look for clues. They are also checking whether other people helped, which means the case may not end with just one arrest.
Analysis
What happened
Spain’s National Police say they arrested an individual accused of leaking sensitive personal data tied to people working in several major state bodies, including the National Cybersecurity Institute (INCIBE), the State Attorney General’s Office, the National Police, the Civil Guard, and the National Security Council.
According to the police, the leak created national security concerns because of who was exposed. Officers raided the suspect’s home after identifying and locating the person they believe was behind the publication of the data, and they seized computers and other electronic devices for forensic analysis.
How the leak appears to have worked
The article says INCIBE posted in February that it was dealing with an ongoing doxing operation and that its own systems were not directly compromised. Instead, the data appears to have been gathered from a mix of older breaches, credential dumps, and OSINT tools, then combined into curated collections.
Some of the leaked records were reportedly outdated, and some names belonged to former INCIBE employees. The group linked to the leak was reportedly called Police-ESP-Doxed, with data posted on a BreachForum instance at the time.
Wider context
The article also notes that in March, personal data belonging to hundreds of Spanish judges and prosecutors was published on Doxbin, including names, DNI numbers, personal mobile numbers, and work email addresses.
Police say they are still examining the seized devices to look for evidence of other participants, so the case may expand beyond a single arrest.
Key points
- Spanish National Police arrested a suspect over a doxing leak involving employees of several key state institutions.
- Authorities say the exposed data created national security risks because of the people targeted.
- Police searched the suspect’s home and seized computers and other electronic devices for forensic review.
- INCIBE had earlier said the campaign was not a direct system breach, but a targeted aggregation of data from other sources.
- Investigators are still checking for evidence of additional participants, so more arrests are possible.
If the investigation holds up, the arrest could slow down the circulation of sensitive personal data and help identify anyone else involved. The seized devices may also give investigators enough evidence to map how the leak was assembled and where the data came from.
The article suggests the data may have been assembled from older breaches and public-source material, which means similar doxing campaigns could keep happening even after one arrest. If other participants are involved, the leak may continue through new accounts or channels before police can fully stop it.
