Authorities in Catalonia are investigating a impressive security breach at Puig de les Basses prison in Figueres, in the Alt Empordà region, after inmates accessed confidential documents stored on the facility’s internal network. The Department of Justice and Quality Democracy said the unauthorized access was detected recently, though it has not disclosed exactly when. Two inmates were involved. Official statements say the breach did not compromise critical penitentiary systems or disrupt prison operations.
Puig de les Basses replaced the former Figueres prison in June 2014, when 150 prisoners moved to the new facility, information from a historical report by 3CatInfo. Investigators are now examining how the inmates reached documents shared on the prison’s internal network. Authorities say basic prison management systems were not affected.
Prison staff noticed irregular network activity and activated security protocols, bringing the incident to light. The Agència de Ciberseguretat de Catalunya was asked to analyze the breach and determine how the inmates accessed the system. Initial findings indicated that those responsible had been identified and that access was limited to documents shared on network drives. Sensitive personal data and basic prison management systems were not affected.
Justice officials reported the case to the Figueres duty court and notified the Catalan Data Protection Authority. The Mossos d’Esquadra’s cybercrime unit is also investigating. Neither inmate is serving a sentence for a cyber-related offence. Sources cited by EL PAÍS said the breach was detected on Sunday afternoon and that the inmates allegedly used recently installed touchscreen terminals, intended for video calls and other services, to access the network.
Catalonia’s prison system is reinforcing digital security measures in response. On Wednesday morning, Domingo Estepa, Director General of Penitentiary Affairs, held an extraordinary meeting with union representatives to brief them on the breach and the response. The UGT union called for full transparency for prison staff and assurances that no employee personal data had been accessed. It also wants a comprehensive investigation to establish the incident’s scope and accountability.
Puig de les Basses houses around 900 inmates, exceeding its stated ideal capacity of 750. The incident highlights the challenges of managing digital infrastructure in correctional facilities as new technologies are introduced. Similar concerns about institutional systems have surfaced elsewhere, including the reported exposure of weaknesses in Spain’s migrant protection network, detailed in a report on the dismantling of a trafficking network in the Canary Islands.
Spain’s prison system increasingly relies on digital tools for communication and administration, putting cybersecurity among its operational concerns. Catalan authorities are pursuing a technical investigation and tightening security measures as they examine how inmates accessed shared documents and work to prevent similar incidents.
