Cangas Council Paid €200,000 Ransom After Cyberattack, Now Investigates 2026

The Cangas de Morrazo city council in Spain paid a €200,000 ransom after a ransomware cyberattack in May 2023, and now a local councilman is under investigation for his alleged involvement in the payment. The case highlights the growing trend of municipalities paying ransoms in Bitcoin and the legal and ethical dilemmas that follow.

What Happened in the Cangas Ransomware Attack?

In May 2023, the Cangas de Morrazo city council suffered a ransomware attack. The attackers threatened to sell the stolen data on the dark web if the ransom was not paid in Bitcoin. The council ultimately decided to pay the ransom, a move that has now triggered a judicial investigation.

The investigation aims to determine whether there were any irregularities in the payment process. As a result, one of its councilmen, Antón Iglesias, has been placed under investigation.

Who Is Under Investigation and Why?

According to ABC, Judge Plaza 2 of the Cangas Court has summoned Antón Iglesias, current councilman for Urban Planning, Housing, and Environment, as an investigated party regarding the ransom payment. Interestingly, at the time of the incident, Iglesias was not a councilman and did not sign the emergency contract to pay the ransom and recover the data.

That contract was signed by Araceli Gestido, who had just become mayor at the time. So far, she has not been summoned to testify, although the judge is expected to call her eventually.

How Was the Attack Managed?

After the cyberattack, the council hired the company EVELB Técnicas y Sistemas S.L. to conduct a forensic study of the affected systems. The first contract amounted to €5,279, but the company did not obtain results. Weeks later, they were hired again to recover the hijacked data.

This time it worked, but not through technical means. Instead, the council paid the ransom in Bitcoin, which raises questions about the effectiveness of the initial forensic contract and the decision-making process.

Key Takeaways from the Cangas Ransomware Case

• Ransomware attacks on municipalities are increasing, and many choose to pay the ransom despite the risks.
• Paying a ransom does not guarantee data recovery and can encourage further attacks.
• Legal consequences can follow for officials involved in the payment, even if they were not in office at the time.
• Transparency and accountability are crucial when handling public funds and cyber incidents.
• Bitcoin payments are traceable, which can aid investigations but also complicate them.

Comparison of Ransomware Payment Outcomes

Why This Case Matters for Other Municipalities

The Cangas case underscores the difficult choices local governments face when hit by ransomware. Paying the ransom may seem like a quick fix, but it can lead to legal scrutiny and may not be the most effective solution. It also raises questions about the role of IT contractors and the need for better cybersecurity preparedness.

Moreover, the investigation into a councilman who was not even in office at the time of the attack suggests that accountability can extend beyond immediate decision-makers. This could have a chilling effect on how officials handle future cyber incidents. The background to this story is set out in Revolut Data Breach: $3M Ransom Demand After Crypto Hack. A related thread runs through Revolut Data Breach: Hackers Demand $3 Million Ransom After Phishing Attack. Earlier coverage in Technology: latest articles shows how the argument developed.

What to Watch Next

The judge is expected to summon former mayor Araceli Gestido to testify, which may shed more light on the decision-making process. The investigation could also lead to changes in how Spanish municipalities handle ransomware attacks, including stricter regulations on ransom payments. A closer look at the same subject appears in North Korea's Cyberattack Superpower: Crypto Theft as Self-Funding. Anyone following the wider picture can start with 911 Malware Attack Exposes Critical Emergency System Risks. The same theme surfaces in Bitcoin Sidechain Breach Drains $320M in BTC: What Went Wrong, which takes a different angle.

As ransomware attacks continue to target public institutions, the Cangas case serves as a cautionary tale about the complexities of paying off cybercriminals. It also highlights the importance of robust cybersecurity measures and transparent incident response plans. Context on how this played out before sits in Bitcoin Cold Wallet Hack: How a Flaw Let Attackers Guess Keys. A companion piece, Cangas Council Paid €200,000 Ransom After Cyberattack, Now Investigates, approaches the same subject from another angle.

FAQ