article_detail

A hacker attack on Spain’s Ministry of Finance is under investigation after a cybercriminal claimed to have accessed tax data on almost the entire population of the country. According to security sources, specialists are now tracing the network to find out who is behind the intrusion and whether any information was actually downloaded.

 

The attacker, who uses the name “HaciendaSec”, says he has obtained “the updated tax database” affecting 47.3 million citizens. In a message posted on a Dark Web forum on Friday January 31 at 7.16pm, he offered the data for sale and described it as covering “47.3 million citizens”. The post has since been removed from the site.

 

The database that is being advertised is said to include full names, national identity and tax identification numbers, postal addresses, telephone numbers, email addresses and bank account numbers, as well as tax information. Cybersecurity experts and state investigators are now checking whether the sample data shown really matches genuine taxpayers and if the figures can be trusted. One source involved in the checks notes that there are “details that do not add up”, although the investigation is still ongoing.

 

Doubts have been raised in particular about the sheer size of the alleged leak. Spain has around 49 million inhabitants, but the number of taxpayers was estimated at around 30 million in 2025. That makes a tax database supposedly covering 47.3 million people look suspicious on paper, and there is still no confirmation that the Ministry of Finance’s core systems have been breached.

 

Even so, state cyberdefence bodies have taken the claim seriously. The National Cryptologic Centre (CCN-CERT), which is part of the National Intelligence Centre and is responsible for protecting public administration, is leading the technical response. Other ministries are also said to be coordinating on the case while specialists try to identify the person or group behind the “HaciendaSec” alias, which appears to have been created specifically for this attack.

 

For ordinary taxpayers, the main concern in the short term is not only whether their data has been exposed, but how it might be used. Experts warn that phishing campaigns (where scammers send fake emails or messages pretending to be from trusted organisations like banks or government offices to trick you into sharing personal details such as passwords or bank information) often follow high-profile breaches, using very realistic-looking communications from official bodies.

 

Citizens are being urged to treat any unexpected messages that seem to come from the Ministry of Finance with caution, especially if they ask for personal or banking details, and to verify anything suspicious through official channels before responding.

 

 

Image: Antoni Shkraba Studio/Pexels