Licence plate leak exposes millions in Spain

A report from the National Police has revealed how a cybercriminal in Murcia got through digital defences and stole data from 40 million license plates.

On February 19, law enforcement apprehended an individual in Murcia, accused of being deeply involved in crimes related to the unauthorised access and disclosure of confidential information.

The arrest, spearheaded by the National Police, came after the discovery that the accused had exploited a flaw in the online tax payment forms on various regional government websites. This breach led to the illegal access of over 40 million records related to vehicles and their owners.

Collaboration spurs success

The investigation was a coordinated effort, involving the General Information Commissioner’s Office, the Computer Crime Prosecutor’s Office, and the Murcia Prosecutor’s Office, under the guidance of Investigative Court number Seven of Murcia.

The Provincial Information Brigade of Murcia and the National Cryptological Centre (CCN-CERT), part of the National Intelligence Centre (CNI), also played vital roles in this operation.

Sophisticated scheme uncovered

Launched in January, the investigation uncovered that around 80,000 records from the General Directorate of Traffic were extracted via the Region of Murcia’s website. The accused had exploited the same vulnerability to perform multiple intrusions into the General Directorate of Traffic‘s computer services.

Since 2020, the perpetrator had been stealthily extracting data, amassing approximately 40 million records to create a quick, marketable database.

Securing the breach

Law enforcement managed to reclaim the vast amount of data and deactivated two additional backup copies hidden by the accused, preventing potential misuse by criminal syndicates.

Intrusions into other autonomous communities’ networks, including Andalucia, the Balearic Islands, and the Canary Islands, were also discovered, highlighting the extensive reach of the cyberattacks.

This operation underscores the General Information Commissioner’s dedication to combating cyber threats that jeopardise national security.

It emphasises the importance of public awareness, as well as the need for collaborative efforts between public and private sectors and international partners to safeguard citizens and governmental bodies from such perilous activities.