Hacker Leaks Alleged Data of Three Spanish Transport Ministry Officials After Adamuz Train Crash

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

A hacker operating under the alias "Vindex" has carried out a targeted doxing attack, leaking the sensitive personal data of three high-ranking officials at Spain's Ministry of Transport. The compromised information was published on a known cybercriminal platform, which constituted a significant security breach for government personnel and triggered a high-level law enforcement response.

Adamuz Train Crash Cyberattack and Political Retribution

The motivation behind the Vindex data leak appears to be political retribution. In the publication, the attacker explicitly blamed the officials for the Adamuz train crash in Córdoba, a tragic incident that resulted in 45 fatalities. 

The alleged leak affects three senior officials of the Ministry headed by Óscar Puente: the Secretary of State for Transport and Sustainable Mobility, José Antonio Santano Clavero; the president of Renfe, Álvaro Fernández Heredia; and the current president of Adif, Luis Pedro Marco de la Peña. 

Impacted details reportedly include:

• ID documents, 
• phone numbers, 
• home addresses.

By linking the data leak to this event, the perpetrator is attempting to frame the hack as an act of vigilante justice, a tactic that escalates the incident from a simple data breach to a politically charged attack. 

Law Enforcement Response and Investigation

In response to the Spanish Ministry of Transport hack, the Spanish National Police have launched a formal cyberterrorism investigation. The primary objective is to identify and apprehend the individual or group operating under the name Vindex. 

The investigation proceeds amid a pattern of similar politically motivated doxing incidents targeting high-ranking figures in Spain. In September, authorities started investigating a massive data leak of top government officials, including Prime Minister Pedro Sánchez.

Related

Okta SSO Accounts Targeted in Vishing Campaign that Uses Custom Phishing-as-a-Service Kits

Venezuela Domain Surge Signals Geopolitical Cyber Activity of Opportunistic Threat Actors Looking to Steal PII and Financial Data

LastPass Backup Phishing Campaign Exposed: Deceptive Requests Target Password Vaults

PcComponentes Incident Was a Credential Stuffing Attack Using Infostealer Logs

Greek Police Arrest Scammers in Athens Using Fake Cell Tower for SMS Phishing Operation

2026 Fortinet Cloud Security Report: The Cloud Complexity Gap Widens

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.

Subscribe for Free

Please enter a valid email address.

Most Popular

Okta SSO Accounts Targeted in Vishing Campaign that Uses Custom Phishing-as-a-Service Kits

UK Considers New Rules on VPNs and Social Media to Protect Children Online

Surfshark Drops App Updates for Older Android Phones: What Users Should Know

Venezuela Domain Surge Signals Geopolitical Cyber Activity of Opportunistic Threat Actors Looking to Steal PII and Financial Data

LastPass Backup Phishing Campaign Exposed: Deceptive Requests Target Password Vaults

PcComponentes Incident Was a Credential Stuffing Attack Using Infostealer Logs

Okta SSO Accounts Targeted in Vishing Campaign that Uses Custom Phishing-as-a-Service Kits

UK Considers New Rules on VPNs and Social Media to Protect Children Online

Surfshark Drops App Updates for Older Android Phones: What Users Should Know

Venezuela Domain Surge Signals Geopolitical Cyber Activity of Opportunistic Threat Actors Looking to Steal PII and Financial Data

LastPass Backup Phishing Campaign Exposed: Deceptive Requests Target Password Vaults

PcComponentes Incident Was a Credential Stuffing Attack Using Infostealer Logs