Cyber Incident Victim: Ayuntamiento de Toledo
Date:
Mar 2025
Location:
Spain
Summary
The city council's website and electronicoffice were hit by a cyberattack claimed by the pro‑Russian hacker group Noname 057, which said the action was retaliation for the Spanish prime minister’s support of Ukraine. The attack disrupted online services but officials said no personal, financial or sensitive data were compromised. Noname 057 had previously been linked to Kremlin‑aligned operations, and three of its members were arrested in Spain for conducting terrorist‑motivated cyberattacks against public and private targets. Municipal IT staff are working to restore normal operation as quickly as possible.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 3, 2025, the Ayuntamiento de Toledo confirmed that its public website and electronic headquarters had been subjected to a cyberattack early that Monday. The municipal IT department reported that the attack disrupted the operability of the online services. The city council stated that the attack was carried out by a Russian hacker group. The group Noname 057 claimed responsibility via social media, saying the attack was retaliation for Spanish Prime Minister Pedro Sánchez’s public support for Ukraine following a meeting between Ukrainian President Volodymyr Zelensky and U.S. leaders Donald Trump and JD Vance. The article notes that Sánchez expressed his support for Ukraine on the social network X, which was referenced by the attackers.
Noname 057 had previously been linked to Russian intelligence services. In July 2024, the Guardia Civil detained three members of the group in Spain; the detainees were Spanish nationals accused of conducting cyberattacks with alleged terrorist aims against public institutions, private companies, and strategic sectors in Spain and other NATO countries. The operation that led to the arrests was nicknamed Grizzlie, a reference to the grizzly bear symbol used by certain cybercriminal groups associated with the Kremlin. The attackers asserted that the Toledo incident was part of a broader campaign in response to Sánchez’s stance on Ukraine. The municipal IT department indicated that the attack also affected other institutions, although it did not name them. Officials said they were working to restore the affected services “as soon as possible.” They emphasized that, according to municipal sources, no sensitive personal, banking, or other confidential data had been compromised in the breach. No further technical details about the attack vector or duration of disruption were provided in the source material.