- A threat actor reportedly stole millions of Spanish taxpayer records from the Agencia Tributaria’s official electronic headquarters, including names, DNI numbers, addresses, and phone numbers.
- The seller shared sample entries from Madrid, Asturias, and Alicante with system timestamps from early to mid-May this year, suggesting the data may be very recent.
- The alleged breach follows a separate 2026 claim that exposed 47 million citizens’ personal details from the Spanish Ministry of Finance, which raises concerns about government data security.
A person involved in cybercrime through an underground hacking forum supposedly has access to a database that includes both private and financial records belonging to approximately 10 million residents of Spain. The seller claims they stole the data from the Spanish Tax Agency, Agencia Tributaria.
The threat actor states that hackers extracted the data directly from the agency’s official electronic headquarters. Spanish citizens and businesses use this secure platform to manage their tax obligations and submit annual returns. The breach, if confirmed, would represent one of the largest exposures of government tax records in recent European history.
The seller accepts middleman and escrow services for the transaction. Interested buyers must contact the threat actor through a Telegram channel to discuss pricing and obtain full database access. Security researchers continue investigating the authenticity of these claims.
Stolen Data Includes National ID Numbers and Tax Records
The stolen information consists of sensitive, personal information such as national ID and tax information. The post on this forum contains the following information for each individual identified: complete name, national ID number, date of birth, home address, and multiple phone numbers.
The identity data includes various identifications from residents of Spain, such as national identification cards (DNI) for Spanish citizens, NIE for foreigners, and CIE for companies.
Similar dark web listings are targeting Brazilian citizens. 2.3 million Brazilian bank records have been advertised for sale, highlighting how cybercriminals are harvesting personal data across multiple countries.
By combining forms of identification with other individuals’ information, cybercriminals can use them to commit both forms of identity fraud.
The threat actor provided sample entries to show the data is authentic. They also provided instances of different taxpayer profiles from multiple cities throughout Spain, such as Madrid, Asturias, and Alicante. Also, they included timestamps for all entries that range from early to mid-May 2026; therefore, this data is likely very recent.
Selling such granular data from a government agency increases the risk of identity fraud for Spanish residents. Cybercriminals can use the collected information to commit different crimes – such as open fraudulent banking accounts, apply for loans, or file fake tax returns. Corporate entities also face risks from the exposed CIF numbers.
Spanish Tax Agency Manages Over 40 Million Taxpayers
The Agencia Tributaria operates as the central tax collection body for the Spanish Ministry of Finance. As such, the agency oversees the financial transactions of more than 40 million taxpayers throughout Spain.
With such a large number of people using their services, it has become one of the most desirable targets for cybercriminals who want confidential information, such as financial or personal details about these taxpayers.
The most recent incident of this nature regarding the alleged data breach has added to the growing concerns regarding attacks on Spanish government institutions. Earlier this year, a separate data breach incident reportedly exposed personal information of about 47 million citizens with the Ministry of Finance; this is just one part of the increase in the number of cyberattacks against Spain’s government entities.
Currently, the Spanish tax authorities have not publicly confirmed nor denied the occurrence of the breach. Researchers are continuing to analyze online underground forums for the validation of the seller’s claims. The authenticity of the dataset remains unconfirmed at this stage.
The government Tax databases contain a lot of data that is valuable data on the Dark Web marketplace because the data includes identifiable, verified personal data belonging to actual people.
These tax records usually contain information about people’s current address, their employer, and their financial relationship, all of which criminals can use in committing fraud and other crimes against that person. The timestamps of the data provided in the sample indicate that the data may have come from very recent queries on the system, rather than from old-archived records.
Spanish Residents at Greater Risk of Phishing and Identity Fraud
A confirmed breach would put Spanish citizens in serious danger of targeted cyberattacks. Fraudsters possessing stolen names, ID numbers, addresses, and phone numbers can create very believable fake messages, a phishing email becomes much harder to spot when it includes the victim’s correct personal details.
The biggest danger after such a leak involves identity theft. Criminals armed with complete personal data can apply for new credit cards, take over existing accounts, or redirect official correspondence; they might also submit bogus tax filings to steal government refunds.
Spanish users need to check bank statements and credit reports regularly for suspicious entries. Requesting fraud alerts from credit agencies provides another shield against identity misuse. Updating login credentials and turning on two-factor authentication for financial and government portals also strengthens security.
The hacker offers to use payment intermediaries and escrow services for the sale, a standard method on criminal forums. These arrangements reduce the chance of cheating between buyers and sellers during illegal transactions. The criminal’s acceptance of escrow may indicate genuine data, but security experts still urge treating the claims as unconfirmed until authorities validate the leak.
