Spanish Ministry of Science Hit by Cyberattack, Disrupting Critical Services Spain’s Ministry of Science, Innovation, and Universities (Ministerio de Ciencia, Innovación y Universidades) has partially shut down its IT systems following a suspected cyberattack, disrupting key services for researchers, universities, and students. The ministry, which oversees science policy, research, and higher education, confirmed a "technical incident" but provided no further details. However, a threat actor claiming responsibility has leaked data samples as proof of the breach. The ministry’s electronic headquarters remains partially offline, suspending administrative procedures while extending deadlines for affected users under Spanish law. A notice on its website assures that measures are in place to protect the rights of those impacted. The attack has been linked to a threat actor using the alias GordonFreeman, who posted stolen data on underground forums, including personal records, email addresses, enrollment applications, and screenshots of official documents. The hacker claims to have exploited an Insecure Direct Object Reference (IDOR) vulnerability, gaining admin-level access to the ministry’s systems. While the leaked data appears legitimate, its authenticity remains unverified. The forum hosting the breach details has since gone offline, and no further leaks have surfaced. Spanish media reports indicate that the ministry has acknowledged the disruption as a cyberattack, though no official statement on the attacker’s claims has been released. The incident highlights growing risks to government systems handling sensitive research and administrative data.

Spain’s Ministry of Science Hit by Cyberattack, Disrupting Research and Education Services A cyberattack on Spain’s Ministry of Science, Innovation and Universities has triggered a partial shutdown of critical government IT systems, halting administrative procedures and exposing sensitive data. Initially dismissed as a "technical incident," evidence now confirms the disruption stemmed from a malicious breach, with potential consequences for researchers, students, and businesses nationwide. The ministry acknowledged the outage in a public notice, suspending all ongoing procedures and extending deadlines under Article 32 of Law 39/2015 until systems are restored. While officials emphasized safeguards for affected users, the lack of early transparency fueled concerns later amplified when a threat actor, "GordonFreeman," claimed responsibility on underground forums. The attacker alleged exploiting an Insecure Direct Object Reference (IDOR) vulnerability to gain "full-admin-level access," sharing unverified screenshots of internal documents, email addresses, and enrollment records. Spanish media reported that the ministry linked the disruption to a cyberattack, though the extent of the breach remains under investigation. The leaked samples including scanned IDs, passports, IBAN numbers, academic transcripts, and personal curricula suggest severe privacy risks if confirmed. Spain’s cybercrime surge compounds the incident’s impact. With attacks rising 35% this year and a 750% spike in early 2025, the country became the most targeted globally in March 2025, accounting for 22.6% of all cyber incidents. Ransomware attacks, up 120%, increasingly target underprotected public institutions, exacerbated by rapid digital expansion outpacing cybersecurity investments. The breach underscores vulnerabilities in Spain’s public-sector infrastructure, where weak defenses turn digital services into liabilities. As the ministry works to contain the fallout, the incident highlights broader systemic gaps in national cybersecurity.