Spanish Intelligence Warns of Russian Cyberattack Targeting Unemployment Benefits Agency

The Russian cyberattack on SEPE that could leave Spain without unemployment benefits

Could a hacker leave millions of unemployed Spaniards without their end-of-month pay? This is essentially what the alert from the CNI (National Intelligence Centre) to Moncloa suggests: suspicious movements to launch a cyberattack against the SEPE (Public Employment Service State Agency). The order to shield the agency came from the General Secretariat for Digital Administration. The government had already acknowledged hacking attempts on some ministries since Pilingui ordered the invasion of Ukraine. And therein lies the problem: the coincidence of dates.

It's important to separate the two layers of the issue. There's an administrative fact—an alert, an internal order—and then there's what each person deduces from it. Between the two, in Spain, years of suspicion are possible.

What the alert about SEPE says exactly

The government acknowledged hacking attempts on some ministries since the start of the war in Ukraine. The novelty, according to what has been released, is the target: an interception that points to the administrative heart of unemployment payments. SEPE manages benefits for those who lose their jobs. If it falls, the payroll of the most vulnerable falls.

So far, that's what's been released. Everything else—whether the attack is real, imminent, or would be successful—is conjecture. And conjectures, at this point, are running wild.

The 'Pilingui Joker': Blame for everything that goes wrong

From there, the pattern repeats. Any domestic disaster—a service outage, a pending adjustment, a new tax—finds its culprit in Moscow. The analogy most circulated in insider circles compares this tactic to a joker card that works for everything and never runs out. Previously, a domestic phantom was used; now the phantom has a Russian passport.

Some argue that this is a perfect alibi: with Pilingui's card on the table, any future cuts are justified.

The €20.3 billion that do have an owner

While the hacking was being discussed, on March 8, 2022, the Ministry of Equality announced the approval in the Council of Ministers of the III Strategic Plan for Effective Equality, with a historic investment of €20.319 billion. The figure immediately became ammunition. That announcement was read as discretionary spending, and the question arose naturally: if there are millions for some programs, why not to cover the unemployment gap?

The accounting isn't that simple—a cross-cutting plan isn't a piggy bank—but the contrast remains. Committed spending on one hand; at-risk benefits on the other. The money, always the money.

Why hack SEPE and not the Treasury?

Here the analysis truly splits. If the goal were to paralyze the state, the logical target would be the Treasury or the banking system, not the unemployment agency. What does Moscow gain by leaving those least at fault without their benefits? It will be said that the objective is social chaos, but chaos doesn't distinguish victims.

The most repeated explanation goes another way: the treasury is running out, and an external culprit is convenient. That money is running out is a less epic hypothesis than the hacker one, but it fits almost everything.

The uncomfortable precedent

A piece of information circulating in forums lingers: the SEPE website already went down for months on a previous occasion, without any Russians involved. This contaminates any current narrative, however real the risk may be.

With these elements, the conclusion writes itself: better an enemy abroad than an audit at home. Geopolitics provides the headline. The money, the fine print.