How a Spanish Cybercrime Gang Stole €140 Million and Almost Got Away With It
Spanish police, working with partners across Europe and beyond, dismantled a fraud network that used fake boss emails, phony investment sites, and nearly a thousand bank accounts to steal the equivalent of $161 million from ordinary people and businesses.
Key points
- Spanish national police announced on 13 July 2026 the arrest of four core members of a cybercrime gang that stole at least €140 million ($161 million).
- The network used more than 70 people, 19 shell companies and close to 1,000 bank accounts to hide and move stolen money.
- Criminals linked to the group stole €61 million through CEO impersonation scams in 2024 alone.
- Police froze €3 million in stolen funds in time to return the money to victims.
- Spanish cybercrime fell 1.6 percent in 2024 according to Spain's Ministry of the Interior, though arrests alone won't solve the problem.
Spain's national police didn't announce a routine bust on 13 July. They announced the takedown of a criminal machine: 70-plus members, nearly 1,000 bank accounts, 19 registered companies, and a haul of at least €140 million ($161 million) before anyone intervened. We first reported the arrests the following day in our story on the fraud ring; this piece goes deeper on how the money actually moved.
The gang ran two central hubs where the actual fraud happened. From those locations, criminals ran CEO impersonation scams, where fraudsters email a company's staff pretending to be a senior executive and instruct them to wire money urgently to a new account. They also ran man-in-the-middle attacks, secretly inserting themselves between two parties to swap in a fake bank account number on a real invoice, and built fake investment websites to lure victims into depositing savings.
How did criminals hide $161 million in stolen money?
Stealing the money is only half the problem. Getting it out without police noticing is the other half.
This group solved it with layers. Money moved from the hackers into shell companies (businesses set up on paper with no real product), then through 120 merchant accounts and 800 bank accounts across multiple countries before anyone withdrew cash. Each layer made tracing harder.
The people doing the withdrawing were recruited for the role. These money mules, individuals paid to move funds on behalf of the real criminals, were often foreign nationals brought into Spain deliberately. As Matt Burch, principal security researcher at Atredis Partners, told Dark Reading, if mules are arrested they're frequently deported before police can interview them, which protects whoever's actually running things.
Four leaders were caught. One, accused of managing the mule network, was arrested while travelling in Panama. Another had recently moved to Porto, Portugal, and was picked up at home alongside a partner.
Police seized 15 computers and 170 smartphones, and froze €3 million before it could disappear, returning it to victims.
Louis Eichenbaum, federal chief technology officer at ColorTokens, told Dark Reading the gang's financial infrastructure was worth more to them than any server. Hackers can spin up new infrastructure fast. Rebuilding a trusted network of shell companies and cooperating banks takes years. Whether this operation delivers lasting damage, Eichenbaum argued, depends on whether authorities can turn the seized financial records into further arrests.
Should you worry?
If your company gets an unexpected email from a senior executive demanding an urgent bank transfer, that's the exact scenario this gang ran repeatedly. Call the executive on a number you already hold before moving anything.
Financial controls requiring two people to approve any new payment destination cost almost nothing to implement and would've stopped the majority of these attacks cold. The fraud infrastructure is gone for now. The playbook isn't.
