A 19-year-old was arrested in Igualada, Barcelona, for allegedly stealing and selling the personal data of millions of individuals sourced from nine companies.
The suspect is accused of trading sensitive information, including national ID numbers, addresses, phone numbers, and IBANs, via hacker forums on the web.
The operation was led by agents of the Policía Nacional, who launched the investigation in June 2025 after detecting multiple data breaches affecting different organizations. The agencies involved managed to trace the activity to a single individual operating under at least five pseudonyms and six separate accounts. The suspect, who has not been named, reportedly monetized the stolen data by selling it through underground forums and receiving payments in cryptocurrency.
According to the police, the data, which constitutes 64 million records, originated from breaches at nine different companies. The stolen records included a wide range of personally identifiable information (PII), such as names, surnames, home addresses, phone numbers, email addresses, national ID (DNI) numbers, and even IBAN bank account codes. The breadth and volume of the data suggest that the targeted entities had large customer bases or operated in sectors where sensitive financial and identity data are collected and stored, though the specific companies have not yet been publicly identified.
During the arrest, authorities executed a search of the suspect’s residence, seizing multiple electronic devices and hardware wallets. They also froze a cryptocurrency wallet believed to hold the proceeds from the illegal data sales. The investigation indicates that the individual ran a well-organized operation, utilizing multiple digital identities to obfuscate their trail and maximize reach across different hacker communities.
The charges brought against the suspect include computer crimes, unauthorized access and distribution of personal data, and violations of privacy laws. Spain's national police emphasized that the volume and sensitivity of the stolen data pose a significant risk of identity theft, financial fraud, and further secondary exploitation on dark web marketplaces.
A 19 year old is not a teen, neither is an 18 year old.