Spain's DGT Data Leak: 34.5 Million Drivers for Sale

Spain's DGT Database with ID and Address Up for Sale

Imagine a traffic dispute. The other driver notes your license plate, and shortly after, they have your full name, national ID number (DNI), home address, and car insurance details on their screen. This scenario ceased to be theoretical when a seller of stolen data put almost the entire registry of drivers from the Dirección General de Tráfico (General Directorate of Traffic) into circulation: 34.5 million rows linking vehicles and people, including license plates, vehicle type, brand, model, owner's name, city, address, and active insurance policy. The ad appeared on May 13 in a marketplace specializing in stolen information. The DGT had not responded to media inquiries at the time of publication.

What Is Offered and For How Much

The seller proposes two options. The first is the entire database, containing those 34.5 million records. The second is more unsettling: on-demand queries, like using a search engine, for those who only need data on a specific person or license plate. "We have access to query any license plate or driver document," the ad states. The price is not listed, but consulted experts estimate it at several million euros.

The value lies not in volume, but in the intersection of data. With DNI, license plate, and address, one can construct a plausible identity theft; adding phone numbers and emails—which circulate in other leaks—completes the equation. A cybersecurity expert summarizes it bluntly: these three fields allow for numerous scams, particularly identity fraud.

Antiestéticared Uses: From Police Stations to Car Dealerships

From there, the scenarios write themselves. Incivil stationed near police station parking lots, logging private cars belonging to officers to find out where they live and pressure them through their families. Luxury car theft gangs no longer need to trinc anyone: having the plate of a targeted vehicle is enough to check where its owner sleeps. A road argument ending with someone knocking on your front door.

There is a less violent and far more common use: knowing if the car someone boasts about owning actually belongs to a company or a renting firm. It changes the reading of an entire parking lot.

Why the DGT? A History of Breaches

No one has explained the exact origin of this leak. Sources investigating the incident point to a recent cyberattack against the DGT, with a domestic actor as the main suspect: the same pattern seen in attacks on Banco Santander, Iberdrola, and Telefónica. Initially, it is ruled out that it relates to the 23-year-old from Murcia arrested after stealing 40 million license plates using his mother's DNI, in an operation coordinated by the General Information Commissionerate with the Murcia Information Brigade and the CCN-CERT, dependent on the National Intelligence Center (CNI). His intention was to sell the database; according to the investigation, he had not yet done so.

The technical diagnosis is devastating. "It has millions of open doors, it's a major problem," note the consulted experts. And the price contrast helps understand the magnitude: querying a vehicle's history costs, according to a comment in the thread, 9 euros at the DGT. The complete base, with 34.5 million drivers, could be negotiated for millions. The same information, two incomparable rates.

Ad Disappears: Removal, Payment, or Trap?

The ad is gone. The material was deleted after the site hosting the sale was seized, and the seller's profile left a message ensuring they can offer individual queries to anyone wanting proof. Interpretations are divided: someone paid enough for the base to disappear from the showcase, or the ad was bait to catch buyers. Neither hypothesis answers the important question: do the 34.5 million records continue circulating in copies in other hands?

Six Days After the News, No Resignations

Once the information was published, the clock ticks and no responsible party appears. Some openly ask when a letter will be sent to citizens asking forgiveness from the 34 million affected and when those responsible will be dismissed. The comparison with the private sector arises in the thread: in a company, such a failure costs heads; in administration, the taxpayer pays the bill and the file ends up in the archives.

The discussion about who is hired to safeguard systems—contractors, subcontractors, and personnel placed indirectly—remains open. Also the fundamental question: is the problem technical, budgetary, or simply one of incentives. The idea hovering over the debate is that no one resigns due to a breach, and that this is part of the design.

Meanwhile, a detail disorients. The same vehicle history that the DGT issues for nine euros—always according to that comment in the thread—is now part of a batch that could be negotiated for millions, and the seller, without the base in sight, continues boasting about being able to query any license plate requested.