Investigation into the leak of personal data belonging to members of sensitive state institutions

During the first few months of 2026, the Spanish authorities detected an unauthorised campaign to disseminate confidential information that affected various institutions deemed sensitive to national security. The investigation was launched after it was discovered that personal data belonging to members of public bodies was being published and shared on various online platforms, posing a risk to the privacy of those affected and to institutional security. From that point onwards, the National Police launched a specialised investigation to identify the source of the leaks, determine the extent of the compromised information and clarify the circumstances under which the data had been accessed and subsequently disseminated.
As a result of the investigation, the National Police arrested a minor in the province of Granada on suspicion of disclosing confidential information. According to official information, the leaked data related to members of organisations such as the State Public Prosecutor’s Office, the National Cybersecurity Institute (INCIBE), the National Security Council, the National Police, the Civil Guard, the Ministry of Finance and the Tax Agency, amongst others. The police operation included a search of the suspect’s home, during which various items of computer equipment were seized for forensic analysis.
The case is currently under investigation by the courts and the police. According to information provided by the Ministry of the Interior, the suspect has been brought before the competent judicial authority and the investigation remains open in order to complete the analysis of the evidence obtained during the search and to clarify all aspects of the incident. To date, the authorities have not publicly reported any further victims, the existence of any other individuals under investigation, or any expansion of the scope of the data breach.