Spanish Police Arrest Teenager Over Theft and Sale of 64 Million Records

Spanish National Police arrested a 19-year-old suspect accused of stealing 64 million personal records from nine companies and selling the data through underground forums. The case raises questions about how a teenager gained access to multiple corporate databases and whether the breached companies have notified affected individuals.

The suspect faces charges including cybercrimes, unauthorized access and disclosure of personal data, and privacy violations. Law enforcement officials stated:

"The cybercriminal gained access to nine different companies, from which he stole millions of records containing personal data, which he then sold online."

Investigation Timeline and Discovery

The investigation began in June 2025 after authorities learned about breaches affecting several companies whose names remain undisclosed. Police traced the suspect to Igualada, a suburb of Barcelona, where investigators confirmed he possessed 64 million personal records.

The stolen data included comprehensive personal information: full names, home addresses, email addresses, phone numbers, DNI numbers (Spanish national identity documents), and IBAN codes for bank accounts. This combination of data types creates significant fraud and identity theft risks for victims.

Spanish authorities haven't disclosed the exact victim count. The 64 million records likely contain duplicates across different breaches, meaning the number of unique individuals affected is probably lower than the total record count. However, even accounting for duplicates, the breach likely affects millions of Spanish residents.

Data Contents and Risk Profile

The inclusion of DNI numbers and IBAN codes distinguishes this breach from typical email and password leaks. DNI numbers function as national identity documents in Spain, similar to Social Security numbers in the United States. IBAN codes provide direct bank account access information.

Combined, this data enables multiple fraud types. Attackers could use DNI numbers for identity theft when opening accounts or applying for services. IBAN codes potentially enable unauthorized banking transactions or serve as targeting information for financial fraud schemes. The complete profile—name, address, phone, email, DNI, and banking details—provides everything needed for sophisticated identity theft or targeted phishing campaigns.

Arrest Details and Evidence Seizure

Police arrested the suspect last week, seizing computers and cryptocurrency wallets allegedly containing proceeds from data sales. The cryptocurrency seizure suggests the teenager converted at least some sales revenue into digital assets, possibly attempting to obscure financial trails or protect funds from seizure.

Investigators determined the suspect operated six different forum accounts using five pseudonyms while attempting to sell stolen data. This operational security approach—multiple accounts and identities—suggests some sophistication in avoiding detection, though ultimately unsuccessful given the arrest.

The use of multiple accounts might have served several purposes: compartmentalizing different data sets to avoid connecting all breaches to a single seller, building reputation across different forums to reach broader buyer audiences, or creating redundancy if individual accounts faced bans or scrutiny.

Unanswered Questions

Spanish National Police haven't disclosed critical details about the breaches:

Company identities: Which nine companies suffered breaches? Without this information, affected individuals can't determine if their data was compromised.

Breach methods: How did a 19-year-old gain access to nine separate corporate databases? Did the suspect exploit vulnerabilities, use stolen credentials, employ social engineering, or purchase initial access from other criminals?

Breach timeline: When did each compromise occur? The investigation started in June 2025, but breaches might have happened months or years earlier.

Victim notification: Have the affected companies notified individuals whose data was stolen? Under GDPR, organizations must report breaches to supervisory authorities within 72 hours and inform affected individuals when breaches pose high risks to rights and freedoms.

Data sales: Who purchased the data? What price did the stolen records command on underground forums? How widely was the data distributed before the arrest?

The lack of company identification particularly concerns affected individuals. Without knowing which organizations were breached, people can't take targeted protective measures or understand their specific exposure.

In My Opinion

The arrest of a teenager responsible for breaching nine separate companies and stealing 64 million records raises uncomfortable questions about corporate security across multiple organizations. This wasn't a sophisticated nation-state actor with advanced persistent threat capabilities—it was a 19-year-old operating from Barcelona.

Per the research findings from Spanish National Police, the suspect used multiple forum accounts and pseudonyms, suggesting operational security awareness. However, the fact that investigators traced the activity back to a specific individual in a Barcelona suburb indicates that these precautions proved insufficient against law enforcement investigation.

The economic incentives behind data theft operations like this deserve attention. Whatever amount the teenager collected from cryptocurrency wallets represented sufficient motivation to risk criminal charges and potential imprisonment. Underground data markets create these incentives, with buyers ranging from identity thieves to fraud operators to marketing database compilers operating in legal gray zones.

The breach of nine separate companies by a single individual suggests systemic security weaknesses across multiple organizations rather than highly sophisticated attack methods. If a teenager could compromise nine different corporate databases, those companies likely suffered from common security failures—unpatched systems, weak authentication, inadequate access controls, or insider threats.

The combination of DNI numbers and IBAN codes in the stolen data creates long-term risks for affected individuals. Unlike passwords that can be changed or email addresses that can be abandoned, national identity numbers and bank account information persist. Victims of this breach face potential fraud attempts for years, requiring ongoing vigilance about identity theft and financial fraud.

Spanish authorities' decision not to name the breached companies creates a transparency problem. While companies might prefer to avoid negative publicity, affected individuals have legitimate interests in knowing whether their data was compromised. GDPR establishes notification requirements specifically to address this—people deserve to know when organizations lose control of their personal information.

The cryptocurrency wallet seizure represents an important law enforcement capability. While cryptocurrency provides some anonymity, it doesn't guarantee perfect operational security. Law enforcement agencies have developed expertise in tracing cryptocurrency transactions and identifying wallet owners through various investigative techniques.

The teenager's arrest likely doesn't fully resolve victim risks. Data sold before the arrest already circulates in underground markets. Buyers who purchased records before law enforcement intervention retain access to that information. The arrest stops future sales but doesn't retrieve already-distributed data.

Organizations should recognize that teenage hackers pose genuine security threats. The stereotype of sophisticated criminal organizations or nation-state actors sometimes obscures the reality that individual actors—including young people with technical skills—successfully compromise corporate systems. Security programs that focus exclusively on advanced persistent threats might overlook simpler attack vectors that enable breaches like this.

The nine-company breach pattern suggests either that the suspect possessed specific technical capabilities that worked across multiple targets, or that multiple organizations suffered from similar security weaknesses. If the latter, Spanish companies should examine whether they share common vulnerabilities—perhaps reliance on specific software with known security issues, similar security misconfigurations, or inadequate security investment.

The investigation's June 2025 start date and subsequent arrest indicate months of investigative work. During that period, the suspect potentially continued selling data and accessing systems. This timeline reflects the reality of cybercrime investigations—identifying suspects, gathering evidence, and building prosecutable cases requires time, during which ongoing harm might occur.

Spanish National Police deserve recognition for successfully identifying and arresting the suspect. However, the larger challenge remains: protecting the millions of individuals whose data was stolen and sold before law enforcement intervention. Those victims face years of potential fraud risk from information they didn't choose to expose and couldn't protect through their own actions.