Alleged Data Breach Targets Spain’s Ministry of Science, Innovation, and Universities

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

A threat actor operating under the alias “GordonFreeman” has claimed a data breach involving Spain’s Ministry of Science, Innovation, and Universities (Ministerio de Ciencia, Innovación y Universidades).
The claims surfaced on February 2, 2026, alleging unauthorized access to ministry systems. 

According to the threat actor’s forum post, the intrusion allegedly exploited an Insecure Direct Object Reference (IDOR) vulnerability. The post alleges this flaw, combined with previously leaked credentials, granted the attacker full administrative-level access to the system.

Details of the Alleged Cyberattack

The "GordonFreeman" actor alleged that the IDOR vulnerability allowed for the sequential iteration of National Identity Document (DNI) numbers, a technique that enables scraping records from unsecured databases.

While the data breach is pending verification, the leaked details suggest unauthorized access to internal records. The scope of the claimed data exfiltration is extensive, reportedly including highly sensitive personally identifiable information (PII). The threat actor lists, among other assets:

• Passport scans, 
• DNI/NIE scans, 
• Apostilled foreign degrees and certified academic transcripts
• Email addresses,
• Payment receipts containing IBANs. 

Implications for Government Cybersecurity

If confirmed, this incident underscores a critical lapse in government cybersecurity protocols regarding access control and data protection. IDOR vulnerabilities are a common but preventable class of security flaws that occur when an application provides direct access to objects based on user-supplied input. 

As the situation develops, security experts are monitoring for the potential release or sale of the exfiltrated data, which could put thousands of citizens and academic professionals at risk of identity theft and financial fraud.

Last month, reports suggested the Pass'Sport data breach that exposed 6.4 million accounts originated from the French Ministry of Sports.

Related

State-Aligned Actors Exploit Unrest with RedKitten AI-Accelerated Campaign Targeting Iranian Protests

Open VSX Registry Deploys GlassWorm Malware via Four Malicious Extension Versions

Mandiant Reports ShinyHunters Extortion Tactics, Vishing, and SSO Compromise Target Cloud Environments 

Vetting the Gaps: Vendor Risk Grows, Vacancies Rise and Security Talent Waits Outside

All Hands on Deck: IPIDEA Proxy Network Disrupted, Swatting Suspects Arrested, Darknet Operators Plead Guilty

Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Affecting ‘Very Limited’ Number of Customers

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.

Subscribe for Free

Please enter a valid email address.

Most Popular

State-Aligned Actors Exploit Unrest with RedKitten AI-Accelerated Campaign Targeting Iranian Protests

Open VSX Registry Deploys GlassWorm Malware via Four Malicious Extension Versions

Mandiant Reports ShinyHunters Extortion Tactics, Vishing, and SSO Compromise Target Cloud Environments 

Vetting the Gaps: Vendor Risk Grows, Vacancies Rise and Security Talent Waits Outside

IPVanish Threat Protection Pro launches in Windows beta

All Hands on Deck: IPIDEA Proxy Network Disrupted, Swatting Suspects Arrested, Darknet Operators Plead Guilty

State-Aligned Actors Exploit Unrest with RedKitten AI-Accelerated Campaign Targeting Iranian Protests

Open VSX Registry Deploys GlassWorm Malware via Four Malicious Extension Versions

Mandiant Reports ShinyHunters Extortion Tactics, Vishing, and SSO Compromise Target Cloud Environments 

Vetting the Gaps: Vendor Risk Grows, Vacancies Rise and Security Talent Waits Outside

IPVanish Threat Protection Pro launches in Windows beta

All Hands on Deck: IPIDEA Proxy Network Disrupted, Swatting Suspects Arrested, Darknet Operators Plead Guilty