Hacienda hacking could have released 47.3 million taxpayers’ personal data

Cybersecurity alerts from the monitoring platform H4ckmanac have raised alarms over two separate alleged cyberattacks targeting key Spanish government ministries in early 2026. These incidents, still under verification, could expose highly sensitive personal and financial information of millions of citizens, including bank details, ID details, addresses and contact details.

Alleged hack on Ministry of Finance: 47.3 million citizens at risk

A threat actor using the alias HaciendaSec claims to have breached the Ministerio de Hacienda (Ministry of Finance) database. The hacker allegedly stole data from approximately 47.3 million individuals, including full names, DNIs (national ID numbers), addresses, phone numbers, email addresses, IBAN bank account details, and tax-related information.

H4ckmanac detected the claim on January 31 and reported that the attacker provided samples of stolen data in a forum post, indicating intent to sell the dataset, possibly on the dark web. The breach remains “pending confirmation”, but if verified, it would rank among the largest data exposures in Spanish government history, and pose severe risks of identity theft, fraud, and financial crimes.

Hacienda have confirmed it is actively reviewing the incident to determine its validity. This follows previous unconfirmed or denied incidents, such as a 2025 ransomware claim by the Qilin group involving 238,799 files, which the Agencia Tributaria rejected as involving personal data leaks.

Breach claim at Ministry of Science and Innovation

On the same day, another hacker known as GordonFreeman announced a successful intrusion into the Ministerio de Ciencia e Innovación (Ministry of Science and Innovation). The attacker described exploiting an Insecure Direct Object Reference (IDOR) vulnerability combined with leaked credentials to gain full administrative access.

This reportedly enabled the extraction of confidential personal and academic records through sequential enumeration of DNI/NIE numbers. Stolen data allegedly includes scanned passports, DNI/NIE copies, apostilled foreign degrees, academic transcripts and grades, payment receipts with IBANs (account numbers), study plans, curricula, enrolment applications, registration proofs, and email addresses.

Experts stress the gravity of full administrative access, which could allow comprehensive control over sensitive organisational information. The incident, also pending official confirmation, is described by monitoring sources as potentially one of the most significant early-2026 breaches in Spain. The ministry has not yet issued a public statement.

Why these vulnerabilities matter

IDOR vulnerabilities occur when systems fail to properly verify user authorisation for accessing internal information, a flaw previously seen in high-profile cases like a 2020 U.S. Department of Defence exposure (mitigated before major damage). Combined with credential leaks, such weaknesses can enable hackers to bypass security and harvest data on a massive scale.

Government response and ongoing verification

Both ministries are investigating, with H4ckmanac continuing to track developments via its X account (@H4ckmanac). No official confirmations of successful breaches have been issued, and the government are urging caution and calm regarding unverified claims. For the time being, 47.3 million people in Spain who could potentially be affected should monitor for signs of fraud and consider enhanced security measures like credit monitoring.