Spacebears claims data breach against Rios Espinosa

• Ransomware group: Spacebears
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: November 4, 2025

Spacebears claims to have stolen data from Rios Espinosa

The threat actor known as Spacebears has published a leak announcement on its dedicated portal, claiming to have obtained sensitive information belonging to the Spain-based firm Rios Espinosa. The announcement, which was posted on the group's leak site, indicates a targeted operation against the organization. While the claim has been made public by the threat actor, the breach remains an unconfirmed allegation at this stage.

According to the information provided by the group, the incident is linked to an attack that allegedly occurred on November 2, 2025. The threat actor's announcement was officially listed on their leak site on November 4, 2025. The group's tactics typically involve the exfiltration of data to exert pressure on the victim, a method often associated with modern ransomware operations.

Details of the alleged data theft

The announcement made by Spacebears specifies the types of information that the group claims to have compromised. The threat actor asserts that they have successfully accessed and stolen various categories of sensitive documentation. According to the group's claims, the compromised data includes:

• Employee personal data
• Client personal data
• Financial documents

The group has not provided specific details regarding the total volume of the stolen data or the exact number of files involved in the breach. Furthermore, there is no information available regarding a specific ransom demand or the exact amount of money requested by the attackers to prevent the release of this information.

About Rios Espinosa

Rios Espinosa is a consulting firm that has been established since 1985. The organization specializes in the fields of economics, law, and property management. Operating through various offices located throughout southern Spain, the firm provides a wide range of professional services to both corporate and individual clients.

Potential implications and risks

This incident, if confirmed, may pose significant risks to the employees and clients of Rios Espinosa. The theft of personal data often leads to increased risks of identity theft and fraud for the individuals whose information has been exposed. Because the firm operates within Spain, a confirmed breach could lead to administrative sanctions and legal proceedings under the European Union's General Data Protection Regulation (GDPR).

The tactics employed by Spacebears, which focus on data exfiltration and negotiation, suggest a double-extortion strategy. In such scenarios, attackers not only encrypt an organization's systems but also threaten to leak sensitive data to increase the pressure on the victim to pay. Additionally, the compromise of financial documents could facilitate highly targeted phishing attacks against the firm's business operations, as attackers may use the stolen information to craft convincing fraudulent communications.

For organizations operating in professional services and consulting, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. As public information regarding the Spacebears group remains limited, organizations are advised to remain vigilant against the evolving tactics used by such threat actors.