A serious security incident at Puig de les Basses prison in Figueres exposed staff members’ personal information after three inmates breached the facility’s computer network in mid-August. Information from union sources, the prisoners accessed employees’ names and ID numbers, as well as their email addresses and car registration details. The Department of Justice and Quality Democracy initially played down the breach, which unions now describe as far more extensive than first acknowledged. ElCaso.cat also reported that inmates at the facility had allegedly accessed Department of Justice computer systems. The report was written by journalist Julio Collado.
Investigators determined that the inmates accessed 12 folders containing around 26,000 documents. Some were shared between departments and could be accessed from multiple computers. The prisoners copied two folders onto a device they used. The files included lists of staff who use electronic signature cards, corporate phone numbers for senior prison officials and volunteers, and vehicle registrations linked to staff identification numbers. Unions are demanding urgent measures to protect affected employees and greater transparency from the authorities.
Technical staff from the Department of Justice, led by Director General of Prison Affairs Domingo Estepa, have met with representatives of UGT and CC OO, as well as Catac, to discuss the investigation and its consequences. The cybercrime unit of the Mossos d’Esquadra’s Criminal Investigation Division and the Catalan Cybersecurity Agency are conducting the probe under strict confidentiality. The agency is preparing a detailed audit. Officials say there is no evidence so far that the stolen data has been leaked or transferred to external devices, but they cannot guarantee this while the investigation continues.
Authorities have assured unions that the attackers did not access the basic staff portal. They also did not access personnel files with photos or banking information. But, the copied documents remain stored on a prison computer accessible to inmates. The Department of Justice says it is still determining the full scope of affected individuals and will notify all impacted staff under data protection regulations once the audit is complete. In response to union concerns, the administration is considering reinstating protected license plates for prison staff vehicles, a measure discontinued in previous years.
Union representatives are also calling for accountability from the IT service provider, citing apparent negligence in system management. The three inmates identified as responsible for the breach have been transferred to separate facilities. None were serving sentences for cybercrimes, and the attack reportedly exploited vulnerabilities in the prison’s recently installed touchscreen video call terminals. System alarms were triggered, and another inmate alerted staff to suspicious activity. Staff then detected the breach.
The incident comes amid a broader cybersecurity challenge in Catalonia. A Generalitat-approved plan to address cyberfraud, developed jointly with the Mossos d’Esquadra and the Agència de Ciberseguretat de Catalunya, reported 53,577 cyberfraud incidents through August 2026, about 220 per day, and characterized cyberfraud as the region’s second most-reported crime. The plan also includes an artificial-intelligence assistant intended to help the public respond to digital threats. These regional figures are not specific to the prison incident.
Cybersecurity incidents in Spanish institutions have become more frequent in recent years, increasing concern about digital safeguards in sensitive environments. The Figueres case follows other high-profile breaches, including the arrest of a serial impostor in Madrid who targeted judicial systems, as reported in a related investigation. Experts say increasingly sophisticated attacks require regular updates to security protocols and closer cooperation between authorities and staff representatives. The Catalan Cybersecurity Agency’s final report is expected to clarify the full extent of the Figueres breach and guide future preventive measures.
