Spanish Police Data Leak: Hacktivists Expose 1,000 Officers in OpDominó

⚠️ THREAT INTELLIGENCE ADVISORY:
A coalition of pro-Russian hacktivist groups operating under the #OpDominó campaign has announced a severe Spanish Police Data Leak. Threat actors claim to have exfiltrated and published the personal identifiable information (PII)—including names, faces, and phone numbers—of more than 1,000 Spanish police officers and civil guards.

This incident represents a significant escalation in the ongoing cyber-harassment campaign against Spain, shifting tactics from opportunistic infrastructure defacement to highly targeted doxxing and psychological warfare against state personnel.

Table of Contents

The Actors Behind the Spanish Police Data Leak

The leak was heavily promoted by a prominent Telegram channel known as “Desinformador Ruso,” which appears to be acting as an orchestration and propaganda hub for multiple hacktivist cells. The groups formally taking credit or participating in this phase of #OpDominó include Z-Pentest Alliance, NoName057(16), and a previously lesser-known entity identifying itself as APT Desi.

By pooling resources and cross-promoting the data dump across their respective networks, this coalition aims to maximize the distribution of the leaked database, complicating takedown efforts by international law enforcement.

Propaganda and Ideological Motivations

The messaging accompanying the leak is intensely political and explicitly anti-NATO. The actors justify the doxxing by accusing Spanish law enforcement of protecting “foreign interests and multinationals” rather than the Spanish public. Furthermore, the broader campaign rhetoric heavily criticizes the Spanish state for its financial and military support of Ukraine.

By exposing the identities of individual officers, the hacktivists are attempting to create a chilling effect among law enforcement while simultaneously fueling domestic political polarization. The use of highly emotive, propagandistic language alongside the data dump confirms that this is not a financially motivated ransomware extortion, but a calculated ideological attack.

Operational Risks of Law Enforcement Doxxing

The exposure of personal phone numbers, full names, and facial imagery of over 1,000 active-duty police officers and civil guards introduces immediate and severe physical security risks.

Primary concerns include:

1. Targeted Harassment: Officers are now vulnerable to coordinated harassment campaigns (swatting, spoofing, and persistent telephonic denial-of-service) by radicalized followers of the hacktivist groups.

2. Spear-Phishing: Exposed personal contact information provides a direct vector for highly sophisticated spear-phishing attacks targeting the officers’ personal devices, potentially serving as a bridge into secure law enforcement networks.

Note: In accordance with CyberAsia’s strict editorial and privacy policies, we will not link to, host, or reproduce any of the Personally Identifiable Information (PII) contained in the threat actors’ database.

Mitigation and Response Protocols

1. Impacted personnel must immediately rotate personal passwords and enable hardware-based Multi-Factor Authentication (MFA) on all personal and professional accounts.
2. Agencies should issue operational security (OPSEC) warnings to affected officers regarding incoming communications from unknown numbers or suspicious email addresses.
3. Authorities must coordinate with Telegram and hosting providers to issue rapid takedown requests for the offending databases.
4. Conduct an immediate forensic audit to determine the initial access vector that allowed the exfiltration of the personnel roster.

CyberAsia is continuing to monitor the escalating threat landscape surrounding #OpDominó. For the latest updates on hacktivist campaigns, see CyberAsia threat intelligence updates.

Mitigation & Prevention Strategies

Data breaches involving Personally Identifiable Information (PII) or sensitive corporate databases require immediate containment and long-term security overhauls:

• Database Hardening: Ensure databases (SQL, MongoDB, Elasticsearch) are never exposed directly to the public internet. Bind services to localhost or strict internal VPCs.
• Data Encryption: Implement robust encryption for data-at-rest. Even if threat actors exfiltrate database dumps, properly salted and hashed passwords minimize the blast radius.
• Credential Rotation: Following any suspected breach, force a global password reset for affected users and rotate API keys and service credentials immediately.

Disclaimer: CyberAsia is an independent Cyber Threat Intelligence (CTI) research organization. The information provided in this report is derived from public intelligence gathering, dark web monitoring, and threat actor claims. It is published strictly for educational purposes, defensive analysis, and public awareness. CyberAsia does not endorse, verify, or facilitate any cyberattacks or illegal activities.