Spanish Police Arrest Suspect in Probe Into AI-Assisted Cyber Intrusions Targeting Public Services

Spanish authorities have arrested a suspect accused of using artificial intelligence tools to facilitate cyber intrusions against municipal infrastructure and private companies providing essential public services.

On 12 November 2026, Spain's Guardia Civil announced the arrest of a suspect in Ciudad Real in connection with multiple alleged unauthorised intrusions into information systems belonging to public and private organisations.

Investigators identified the Ciudad Real City Council and a software company providing electronic management and administration services to public bodies among the affected organisations.

Inside the investigation

According to the Guardia Civil, the suspect allegedly used artificial intelligence tools extensively to support the intrusions. These tools helped acquire technical knowledge, resolve difficulties, develop procedures and overcome obstacles encountered while accessing targeted systems.

Investigators said the use of AI significantly expanded the suspect's technical capabilities beyond their previous level of expertise, lowering the technical barriers associated with carrying out these activities.

One of the principal targets was Ciudad Real's Low Emission Zone (ZBE) management platform. Following the cyber intrusion, the city council was forced to suspend the digital platform.

A software provider delivering essential services to citizens and public administrations was also affected. Investigators identified additional public institutions and service providers whose systems had reportedly been accessed without their knowledge.

Organisations and services affected

The incident highlights the potential consequences of intrusions targeting both government infrastructure and third-party technology providers.

The affected entities include:

• Ciudad Real City Council: Its Low Emission Zone management platform was accessed without authorisation and subsequently suspended.
• Public-sector software provider: A company supplying electronic management and administration services to public bodies was also targeted.
• Additional organisations: Investigators identified other public institutions and private service providers whose systems had been compromised.

The full number of affected organisations and the extent of information accessed have not been publicly detailed.

The role of artificial intelligence

The investigation highlights how AI tools can potentially enable individuals with limited technical experience to undertake more sophisticated cyber activities.

In this case, investigators found that AI-assisted tools were used to obtain specialised knowledge, troubleshoot technical challenges and develop procedures for carrying out unauthorised system access.

Rather than independently conducting the attacks, the tools reportedly supported the suspect throughout the intrusion process.

This demonstrates how AI can lower the technical barriers to cybercrime while potentially increasing the capabilities of individual attackers.

Investigation and law enforcement response

The Guardia Civil stated that its investigation identified numerous affected organisations and enabled authorities to notify them of the unauthorised access, allowing them to strengthen their security measures and prevent further incidents.

The suspect faces allegations involving the discovery and disclosure of secrets, unlawful access to information systems and attempted extortion of victims.

The investigation was coordinated by Plaza No. 3 of the Civil and Investigative Section of the Tribunal de Instancia in Collado Villalba.

The Guardia Civil reiterated that unauthorised access to computer systems, as well as the alteration, deletion or disclosure of stored information, can result in criminal liability under Spanish law.

Sources

• Guardia Civil – Official announcement, 12 November 2026
• El Mundo