Spanish Police Dismantle Cybercriminal Network, Hacker ‘Alcasec’ and Former Secretary of State for Security Arrested

• Spanish authorities arrested a notorious hacker using the nickname Alcasec for involvement in a cybercriminal network.
• The former Secretary of State for Security was also detained for cyberattacks on national infrastructure.
• The attackers exfiltrated millions of sensitive records from civil registries, electric company billing, and more.

Spanish authorities have disbanded a major cybercriminal network, culminating in the arrest of the notorious hacker "Alcasec" (José Luis Huertas) and the former Secretary of State for Security, Francisco Martínez. 

Under "Operación Borraska," police, in collaboration with the National Cryptologic Center (CNI) and the Andorran Police Force, targeted an organization responsible for coordinated, systemic intrusions across key public and private sectors.

The group, described by law enforcement as a “structural threat capable of economic and strategic destabilization,” is accused of orchestrating prolonged cyberattacks on the IT infrastructure of government bodies, energy providers, transportation systems, educational platforms, and telecommunications networks. 

🚩Desmantelada una #red de inteligencia dedicada a cometer #ciberataques a organismos públicos y empresas estratégicas

🔹4 personas detenidas en #Madrid, #Córdoba y #Andorra

🔹Desarrollaron una infraestructura tecnológica sofisticada con servidores en la nube y transacciones… pic.twitter.com/xCbPaZQ5F7

— Policía Nacional (@policia) May 28, 2025

Through these sophisticated campaigns, the attackers exfiltrated sensitive and private data from millions of Spanish citizens—including information from civil registries, pet databases, transportation and telephone records, and electric company billing platforms.

Investigators uncovered that the network had developed an integrated technological platform allowing them to store, organize, and commercialize segmented data linked to both individuals and legal entities. 

This infrastructure enabled the creation of comprehensive personal profiles through real-time cross-referencing, with access sold to third-party actors via encrypted bots on popular social networks. The system operated via distributed cloud servers designed to be opaque to law enforcement interventions.

The investigation revealed the group’s private intelligence structure, encompassing technological administration, anonymity tool development, crypto asset–based financial management, legal strategizing, and international expansion with trading activity on dark markets. 

Allegedly, the network leveraged established professional relationships and the guise of legitimate technology consulting to insert itself into sensitive segments of corporate and institutional environments, facilitating money laundering and evading scrutiny.

Of particular note, Martínez, who previously served under Spain’s People’s Party government and is awaiting trial related to the “Kitchen” scandal, is alleged to have assisted Alcasec with company creation, though defense sources deny his involvement in operations or financial management.

Authorities successfully dismantled the network’s infrastructure, recovering compromised databases and exposing the extent of system infiltration.