The Spanish Tax Agency "leak": when digital panic hides the real problem

On 31 January we woke up to news that, if true, would chill the blood of any compliance officer: an alleged massive leak from Spain's Tax Agency (AEAT) compromising 47 million records of Spanish citizens. According to the initial alert spread by threat intelligence firms such as HackManac and reported by media such as El País, an actor using the alias "HaciendaSec" was allegedly selling this information, which supposedly included everything from tax ID numbers (NIF) to bank details. However, before giving in to collective panic, it is our duty as cybersecurity professionals to stop, breathe and analyse the facts with a technical magnifying glass, because some pieces of this puzzle frankly don't fit.

The first thing that stands out is the attacker's identity. In the cybercrime ecosystem reputation is everything, and the alias "HaciendaSec" has no recognised track record on dark web forums to back an operation of this scale. According to various threat intelligence sources, we are not dealing with an established ransomware group with known infrastructure, but with a profile that appeared out of nowhere claiming the "crown jewels" of the public administration. That alone should switch on our scepticism about the veracity, or at least the freshness, of the data.

Add to this the question of volume and detection capability: extracting 47 million records from critical infrastructure such as the Tax Agency's without triggering a single alarm is, with today's technology, extremely unlikely. We are talking about a volume of data traffic (exfiltration) that would generate deafening digital "noise" in any modern SIEM (security information and event management system). The fact that the Tax Agency itself stated that, after reviewing its systems, it found no evidence of intrusion or service disruption gives us some reassurance; if there were an active backdoor draining that amount of information in real time, network traffic monitors would be glowing red.

So, if we assume that the data sample presented by the attackers is real (even if partial), where does it come from? This is where we need to look beyond the movie-style hack. The theory of an insider or disloyal employee extracting such volume is possible, but logistically complex without leaving an immediate forensic trail. Personally, and based on similar cases we have analysed in the sector, I lean towards a less sophisticated but more painful hypothesis: poor management of obsolete technology assets.

It is very likely that we are not facing an intrusion into current servers, but the "resurrection" of old information stored on retired hardware. It happens more often than we think: servers, storage arrays or tape backups are decommissioned and leave the organisation without going through a certified secure erasure or physical destruction process. If a hard drive with a database from three or four years ago ends up on the second-hand market without being properly sanitised, a third party can recover that information and present it today as a "recent hack" to inflate its value on the black market.

The lesson for companies, and especially SMEs, is critical: cybersecurity does not end when the firewall stops an attack or the antivirus cleans a file. Security covers the entire data life cycle, right up to its death. There is no point in having the most impregnable digital fortress if, when we replace the office computers or change the server, we hand the old equipment over to a third party without guaranteeing that the information it contained has been irreversibly destroyed.

At Ciberseguridad 720 we always remind people that the weakest link is sometimes not a user clicking a link, but a hard drive forgotten in a drawer or sold for scrap. Asset management and secure erasure are not just bureaucratic formalities; they are the last line of defence for our reputation.

The Ciberseguridad 720 team