Spanish police probe DGT hack, millions of driver's info exposed

The personal information of millions of Spanish drivers was allegedly posted on a popular hacker forum causing police to launch an investigation into a possible hack of Spain’s Directorate-General of Traffic (DGT).

Spanish police announced the inquiry on Friday after discovering a database of vehicle drivers had been offered up for sale online after the traffic authority detected an attempted data breach earlier this month.

Two weeks ago, the Directorate-General of Traffic (DGT) detected suspicious activity from users trying to access its database, a spokesperson told Reuters.

The DGT blocked them and alerted the Traffic Investigation and Analysis Group (GIAT), which opened an investigation, the Guardia Civil police force said.

The DGT's database contains detailed information - including license plate numbers and insurance data - on more than 27 million drivers registered in Spain.

An anonymous user claimed in a post on the hacking crime forum BreachForums that they had "access to look up any license plate or document number" and were selling the full DGT database.

📣Si cambias de domicilio debes comunicarnos tu nueva dirección postal en un plazo de 15 días para que puedan llegarte notificaciones. Puedes hacerlo sin acudir a una Jefatura de Tráfico:
▶️☎️ 060
▶️🌐https://t.co/ZQpZzPRTSR
▶️📱 app #miDGT https://t.co/ZOM0Ik9Vwd pic.twitter.com/ickyYtl95N

undefined Dir. Gral. Tráfico (@DGTes) May 30, 2024

"We'll have to see if there's any truth to what is being said. In data-selling forums, they often claim to be selling things they don't actually have," the DGT spokesperson said.

Over the past month, three of Spain's largest companies - telecoms giant Telefonica, lender Santander, and energy company Iberdrola - have reported suffering cyberattacks that led to breaches of employee and customer data.

According to a report by the Department of National Security, the total number of cyberattacks registered last year nearly doubled from 2022 to over 100,000 incidents, 130 of which were classed as "critical."