Thirty-four cybercrooks who stole data of 4 million people arrested in Spain

The Spanish National Police have broken up a cybercriminal organization that used computer scams to steal and monetize the data of over four million people.

Thirty-four members of the crime group were arrested in Madrid, Malaga, Alicante, Murcia, and Huelva. During the raids, law enforcement confiscated firearms and hand weapons, high-end cars, 80,000 euros ($85,400) in cash, and computers hosting a database with information on millions of people.

In a press release, the Spanish police explained that the gang carried out several fraudulent activities and earned about €3M ($3.2M) by carrying out various types of scams and reselling the stolen data to other cybercriminals.

The group conducted smishing, phishing and vishing campaigns that impersonated delivery companies and electricity suppliers.

The scammers also carried out the so-called “son in distress” scams. These are performed by calling parents to make them think their child is in trouble and to convince them to send over the apparently “urgently-needed” cash.

In other cases, the crooks reportedly took advantage of an insider's position in an international tech firm to reroute merchandise to addresses under their control. Their scamming repertoire was wide, in other words.

The leaders of the criminal gang used false documents and employed spoofing techniques to hide their identities. They invested their profits in crypto assets to launder the proceeds.

The investigation started at the beginning of this year when special agents of the Central Cybercrime Unit identified a criminal network that illegally accessed databases of various financial and credit entities, entering different amounts of money into client accounts from the credit institutions, the Spanish police said.

“They then contacted those clients informing them that, due to a computer error, they had entered a loan and had to return it,” explained the police.

For instructions on how to return the funds, the victims were directed to phishing sites impersonating their banks and entered sensitive data that was sent over to the criminals.

Late in 2022, another cyber gang was busted in Spain. A SIM card-cloning clique had netted €250,000 ($267,000) by draining the bank accounts of a hundred victims after tricking their phone companies into giving it access to their personal details.