Teenage hacker tied to high-profile cyberattacks arrested by Spanish police

Spanish police announced Tuesday that they arrested a 19-year-old suspected of carrying out a range of high-profile cyberattacks, calling him a “serious threat to national security.”

José Luis Huertas, known online as “Alcasec,” had been on the police’s radar since November 2022, when investigators tied him to a cyberattack on Spain’s national council of the judiciary (CGPJ). The breach affected several other public institutions, including the State Tax Administration Agency, and led to the exposure of personal data, account numbers, bank balances, and other sensitive information.

Huertas, who police said has “extensive experience in the world of cybercrime,” is also accused of several other high-profile incidents, including stealing hundreds of thousands of euros through impersonation attacks. Additionally, he allegedly ran a platform called Udyat — a reference to the Egyptian symbol known as “the eye of Horus” — to sell large amounts of stolen data.

Huertas allegedly attempted to conceal the proceeds through cryptocurrency mixing services, which pool together digital coins and redistribute them to make it harder for investigators to link funds to recipients.

Law enforcement agents, however, seized “a large amount of cash” and a luxury vehicle from Huertas’ home, as well as documents and computers that are being analyzed.

Huertas “led a life of luxury inappropriate for someone his age and without work activity,” police said, adding that they were assisted by the country’s National Cryptological Center and National Intelligence Center. “He made expensive trips, wore exclusive brands, frequented fashionable leisure and restaurant venues, and even drove a high-speed vehicle.”

Spanish media reported that Huertas has been placed in provisional prison until his trial due to his risk of absconding.