A 25-year-old man was detained in Madrid for illegally accessing restricted government databases. Police say he used a bot created by convicted hacker Alcasec. The case highlights ongoing risks to sensitive citizen data.
Spanish police have arrested a 25-year-old man in Madrid, accusing him of infiltrating confidential government databases using a sophisticated encrypted bot. According to the Ministry of the Interior, the suspect allegedly gained unauthorized access to sensitive information by leveraging a tool developed by the notorious hacker José Luis Huertas, known as Alcasec, who has previously been convicted for similar cybercrimes.
The investigation points to the suspect as a trusted associate within Alcasec’s inner circle. Authorities believe Alcasec provided the encrypted bot free of charge to select individuals, enabling them to conduct illegal real-time queries on restricted databases. The arrest forms part of the ongoing Operation Borraska, which previously led to the detention of Alcasec himself, former Secretary of State for Security Francisco Martínez (now on trial in the Kitchen case), YouTuber Álvaro Martín (Valyrio), and another alleged accomplice, Adrián Molina.
Police link the group to a series of systematic cyberattacks targeting public institutions, energy companies, ports, transport systems, telecom networks, and educational platforms. One of the most significant breaches involved the Comisión Nacional de los Mercados y la Competencia (CNMC), which reported a massive leak of personal data from mobile phone subscribers. This incident triggered a broader investigation by the General Information Commissariat in 2024, resulting in five arrests to date.
Investigators describe the network as a “criminal organization” that built a highly compartmentalized technological infrastructure. This setup allowed them to steal confidential data from millions of citizens, including records from educational systems, civil registries, pet registries, transport passes, phone logs, and utility billing platforms. The stolen information was then sold on the black market, with profits allegedly laundered through complex corporate structures.
The encrypted bot at the heart of the operation enabled users—even those without advanced technical skills—to extract personal data from restricted sources in real time. Police note that the group’s daily operations relied on end-to-end encrypted communications, false identities, cryptocurrency transactions, and anonymity tools. Servers hosting the necessary infrastructure were distributed across cloud platforms, which the group believed to be beyond the reach of law enforcement.
Alcasec, a familiar figure to Spanish authorities, was first detained in 2020 as a minor for hacking private companies and public agencies, including the theft and publication of the medical record of Vox leader Santiago Abascal. In 2022, he was arrested again for breaching the servers of Holaluz, stealing confidential data from the company and 37,000 clients, and for hacking the Punto Neutro Judicial (PNJ), which connects judicial bodies with other state institutions. This latter breach gave him access to the Spanish Tax Agency and data on over half a million taxpayers. In May of the previous year, Alcasec accepted a sentence of two years and seven months in prison for these offenses.
Spain has seen a rise in high-profile cyberattacks targeting both public and private sectors in recent years. The increasing sophistication of criminal networks, often using encrypted tools and cloud-based infrastructure, poses ongoing challenges for authorities. The Operation Borraska case underscores the persistent threat to personal data security and the evolving tactics of cybercriminals operating within Spain.
