Actor claims leak of 8,206,985 records from Spanish platform Bittools
On October 27, 2026, a threat actor posted on X a database of 8,206,985 records (about 2.57 GB) claimed to belong to Bittools.es, a Spanish marketing and data services platform run by Bitmon Marketing Systems. The claim is unverified and the company has not publicly confirmed an incident. The alleged sample includes names, addresses, phone numbers, DNI/NIF tax IDs and CUPS electricity codes, data useful for utility scams and identity fraud.
What happened
A threat actor posted on X a database of 8,206,985 records (about 2.57 GB) claimed to belong to Bittools.es, a Spanish marketing and data services platform run by Bitmon Marketing Systems. The alleged sample includes names, addresses, landline and mobile numbers, DNI/NIF tax IDs and CUPS electricity supply codes. The company has not confirmed an incident and the data has not been verified.
Why it matters
If confirmed, the dataset enables fake utility and bank calls, smishing and identity fraud in Spain, using real tax IDs and energy supply codes. Companies with customers in Spain may see fraud waves and increased support calls.
What to do
Treat it as an unverified claim. Monitor mentions of Bittools and Bitmon Marketing Systems and strengthen fraud and phishing alerts for customers in Spain.
For the technical team
- Affected
- Bittools.es, plataforma espanhola de marketing e serviços de dados da Bitmon Marketing Systems · Bittools.es, a Spanish marketing and data services platform run by Bitmon Marketing Systems. No specific version or system cited.
- Exploitation
- No exploitation reported. Alleged publication on X on October 27, 2026, reported by @DailyDarkWeb. No data verification, no company confirmation and no KEV entry.
- Fix
- No fix applicable; the sources classify the case as an unverified threat-actor claim.
- Vector
- Alleged data leak, with no technical vector described in the sources. The origin of the database is unknown; the source analyst notes the data may be compiled from older sources.
- More details
- Alleged sample: names, addresses, landline and mobile numbers, DNI/NIF tax IDs and CUPS codes. The combination of DNI/NIF with phone numbers and energy supply codes is cited as ideal for fake utility and bank calls, smishing and identity fraud. Alleged volume: 8,206,985 records, about 2.57 GB. Single source: @DailyDarkWeb post on X.
Timeline
Post on X claims leak of 8.2 million records with personal and tax data attributed to Bittools.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
