The tax authority in Spain, Agencia Tributaria (AEAT), has denied any breach of its systems following an alleged tax hack. Investigations now suggest that a private tax consultancy firm may have been targeted instead.
AEAT reaffirms security of systems
AEAT continues to deny any security breach of its IT infrastructure. This statement follows a preliminary report into an alleged attack by hacker group Trinity. According to El Confidencial, initial findings indicate that an external private company, not affiliated with AEAT, may have been compromised.
The Spanish Ministry of Finance, under which AEAT operates, stated that there is no evidence of any data compromise within its systems. Moreover, AEAT added that Trinity has not requested a ransom directly from them, nor provided any proof of possessing taxpayer information.
Consultancy firm targeted, not AEAT
Data obtained during the investigation points towards a private firm specialising in tax and labour advisory services as the potential victim. This firm handles tax data for individual clients and small businesses. Authorities have yet to disclose its identity, but current findings suggest that AEAT’s systems were unaffected.
Final report still pending
The findings remain preliminary, and confirmation will only be possible once the final report is released. The situation is still fluid, especially as the Trinity group claims to hold 560 GB of AEAT data and has threatened to release it unless a $38 million ransom is paid by December 31.
Growth of cybercrime and motives of cybercriminals
Cybercrime has been on the rise globally, with attacks on both private companies and government institutions becoming increasingly common. The sophistication of these attacks has evolved significantly, making it challenging for even the most secure systems to remain unaffected. Recent years have seen an increase in ransomware attacks, data breaches, and phishing schemes, targeting sensitive data for financial gain.
Typically, cybercriminal groups like Trinity aim for financial gain through a variety of deceptive tactics. If the hackers do indeed possess taxpayer information, it is also possible that the stolen data comes from previous cyber incidents rather than a direct attack on AEAT. The growing threat of cybercrime highlights the importance of robust cybersecurity measures for both public and private entities.
Also read: These are the most hacked passwords within Spanish-speaking countries