Cybersecurity news

25 September 2026Hipertextual

500 GB

taken, according to investigators

Adif and Renfe hacked: around 500 GB of passenger data

The attackers got in through Adif's website, moved to its cloud and from there into Renfe systems; investigators say AI was used to find the flaw. Renfe speaks of customer names and emails, with no payment data, while press reports put the haul at around 500 GB. Train services were not affected; the immediate risk is phishing emails and texts posing as Renfe.

30 September 2026CyberScoop

110 TB

of stolen data secured

Operation KillSwitch takes down KillSec; its alleged leader is 16

Police from ten countries, Spain among them, seized the KillSec ransomware leak site on 30 September, with three arrests and eight searches in Spain, Greece, Romania and the UK. Five central servers and at least 110 TB of stolen data were secured. Active since 2024, the group claimed around 1,000 attacks, about 500 of them confirmed.

23 September 2026The Record

5,000

agent records verified

ShinyHunters breaches the FBI jobs portal

The group defaced FBIjobs.gov with its Pokémon mascot and claims to hold data on every agent and applicant in the system. Outlets including Reuters and 404 Media verified a sample of 5,000 agent records. The FBI confirmed it is investigating, and the special agent application portal went offline.

14 September 2026INCIBE-CERT

Report

1st

reported breach carried out by an AI agent

Spain's data protection agency receives its first breach carried out by an AI agent

An undisclosed Spanish organisation reported an attack in which an autonomous AI agent searched for flaws, logged in and explored the application on its own until it could modify personal data and view invoices. It is the first notification of its kind received by the Spanish Data Protection Agency (AEPD), which is still analysing the case.

25M

Salesforce records

2 August 2026DeXpose

ShinyHunters claims 25 million Alcon Salesforce records

The extortion group listed Swiss pharmaceutical company Alcon on its leak portal on 2 August, claiming more than 25 million Salesforce records containing personal data. It gave the company until 4 August to respond before publishing. Same playbook as the CRM-targeting campaign that has hit dozens of major brands this year.

Report

392

attacks in a year

28 July 2026Que.es

Ransomware doubles in Spain: from 176 to 392 attacks in a year

Recorded cases went from 176 to 392 in twelve months, according to INCIBE, CCN-CERT and ESET data. Inditex and Endesa are among the 2026 victims, both breached through an external technology supplier. The most common way in hasn't changed: stolen credentials and VPNs without two-factor authentication.

16 July 2026The Hacker News

£29M

in losses for Transport for London

Five and a half years in prison for two Scattered Spider members

Owen Flowers (18) and Thalha Jubair (20) were sentenced on 16 July at Woolwich Crown Court over the 2024 Transport for London attack, which knocked out 148 systems and forced 27,000 staff to reset passwords in person. The incident cost £29 million in losses and recovery. They are the first people convicted under Section 3ZA of the Computer Misuse Act.

$300M

in ransoms attributed to 'Stern'

14 July 2026Chainalysis

EU, US and UK sanction 'Stern', the Trickbot administrator

Vitaly Nikolayevich Kovalev, alias 'Stern', ran Trickbot with CEO-like authority: wallets tied to him received more than $300 million in ransom payments. The coordinated 14 July action also hit the developers of the LummaC2 infostealer, bulletproof host Media Land and a VPN used by ransomware operators.

27M

stolen credentials recovered

19 June 2026Paubox

Operation Endgame: 326 servers seized, 27 million credentials recovered

Between 15 and 19 June, Europol and police forces from seven countries dismantled the infrastructure behind Amadey, StealC and SocGholish: 326 servers seized, 142 domains taken down and $46 million in cryptocurrency frozen. The operation recovered 27 million stolen credentials and cleaned up nearly 15,000 infected websites.

Data leak

8.3 TB

of credentials left in the open

17 June 2026Malwarebytes

24 billion stolen records left exposed on a passwordless server

Cybernews researchers found 8.3 TB of data on an Elasticsearch cluster open to the internet, pulled together from 36 different sources. Inside were infostealer logs with usernames, emails and plaintext passwords, plus session cookies, tokens and browser autofill data. The server was taken offline shortly after the discovery.

10 June 2026Infosecurity Magazine

€336m

laundered since 2022

AudiA6 taken down: the service that laundered €336m for ransomware gangs

On 10 June the FBI, Europol and the US Secret Service dismantled AudiA6, a platform charging commissions of up to 10% and tied to laundering for at least 15 ransomware operations between 2022 and 2025. Two administrators, Ukrainian and Russian nationals, were arrested in Georgia; more than 30 servers and 25 domains were seized.

Data leak

5,995,277

people affected

31 May 2026Malwarebytes

Carnival confirms a breach affecting nearly 6 million travellers

It started with social engineering against a single employee account; the security team flagged the activity on 14 April. Exposed data includes names, addresses, phone numbers, dates of birth and government ID numbers such as passports and driving licences. ShinyHunters claimed the attack and said it held 8.7 million records.

years old, the suspect

27 May 2026Euronews

Minor arrested in Motril for leaking data on police, prosecutors and INCIBE

On 27 May Spain's National Police arrested a 16-year-old identified as the author of a doxing campaign against members of sensitive state institutions: INCIBE, the Attorney General's Office, the National Security Council, the Guardia Civil and the Tax Agency. He faces a charge of revealing secrets, and officers seized all of his computer equipment for analysis.

290

stores in the chain

5 May 2026Bit Life Media

Qilin hits Spanish grocer Ahorramás and publishes accounts and ID numbers

On 5 May the Qilin group announced an attack on the supermarket chain, which runs more than 290 stores across Madrid, Castilla-La Mancha and Castilla y León. It used double extortion and posted proof of the theft on the dark web: accounting documents, store floor plans and personal data. Ahorramás notified INCIBE and the Spanish data protection agency and kept its stores running.