Gestordes listed on Space Bears leak site

• Ransomware group: Space Bears
• Country: Spain
• Sector: Professional Services
• Announcement date: May 27, 2026

Space Bears claims breach of Gestordes

The threat actor known as Space Bears has listed the Spanish professional services firm Gestordes on its leak site. According to the announcement made on May 27, 2026, the group claims to have compromised data belonging to the organization. The threat actor has initiated a countdown process regarding the publication of the institution's data, a common tactic used in extortion-focused cyberattacks to pressure victims.

The group claims that the attack occurred on May 3, 2026. While the group has published a listing regarding the data breach, they have not provided information regarding a ransom demand or the specific size of the stolen data, though they have specified a file count. This type of activity is characteristic of modern ransomware operations that utilize double extortion techniques, where stolen data is used as leverage to compel payment.

Details of the alleged data exfiltration

The announcement made by Space Bears states that over 200,000 files related to the administrative management processes of Gestordes have been exfiltrated. The group claims that these files contain sensitive information that could impact both the organization and its clients. The leaked content reportedly includes various types of documentation essential to the firm's operations.

The specific types of data mentioned in the claim include:

• Client ID information
• Client passport information
• Financial documents

The presence of such sensitive information, including identity documents and financial records, highlights the high-stakes nature of these types of breaches. When threat actors target professional services, they often aim for high-value data that can be used for further malicious activities or secondary extortion.

About Gestordes

Gestordes is an administrative management firm based in Ordes, Spain. The organization provides professional management services in the fields of accounting, tax, and labor law for both businesses and individuals. Because the firm handles sensitive client information related to legal and financial matters, it serves as a repository for significant amounts of private data.

Impact and security implications

The nature of the alleged leaked data may increase the risk of identity theft and fraud for the institution's clients. Given that the institution is based in Spain, the breach may lead to legal sanctions under the European Union's General Data Protection Regulation (GDPR). The data exfiltration and extortion-focused approach of the Space Bears group suggests that the institution may be exposed to secondary extortion attempts.

Furthermore, the leaked financial documents could negatively impact the institution's commercial reputation and potentially trigger supply chain risks. In the professional services sector, the loss of client trust and the exposure of sensitive financial data can have cascading effects on the business relationships the firm maintains.

In general, organizations facing such threats often focus on incident response and forensic investigations to determine the full scope of the compromise. Defensive strategies typically include strengthening access controls, implementing multi-factor authentication, and maintaining robust backup solutions. For firms handling sensitive personal data, compliance with regional regulations like GDPR is a critical component of their operational risk management to mitigate the legal and financial consequences of a potential breach.