The hacker José Luis Huertas, known as Alcasechas accepted a sentence of two years and seven months in prison for stealing more than half a million citizens’ banking details after
Alcasec, 22 years old, reached an agreement with the prosecutor this Wednesday at the National Court. For confessing to the crimes of illegal access to computer systems and discovery and disclosure of secrets, the young man has had his initial request of three years in prison reduced.
Likewise, they have agreed to a compliance with the prosecutor’s office. hacker Daniel BE and Juan Carlos OG, who have confessed and accepted two years and two months in prison, the first as a cooperator and one year and three months for discovery of secrets, the second. They have also accepted the confiscation of the effects and physical and virtual money that were seized from them following the searches carried out at the home and a premises of Alcasec in Madrid, the habitual residence of Daniel BE in Cartagena (Murcia) and the home of Juan Carlos OG in Dos Hermanas (Seville).
The prosecutor has explained that she has valued the collaboration of the accused in providing their codes and passwords during the investigation. Alcasec has been in provisional prison for a year for another reason, related to a network of cyberattacks that seized the sensitive and private data of millions of citizens and that he allegedly led.
He was arrested in May of last year for these events, who is currently being tried for Operation Kitchen, allegedly orchestrated by the Ministry of the Interior during the PP Government of Mariano Rajoy to spy on the party’s former leader Luis Bárcenas.
When his arrest occurred, Alcasec was on provisional release after having spent a month and a half in prison following his arrest in March 2023 for the attack on the CGPJ website. The judge of the National Court José Luis Calama agreed to release him with the approval of the Prosecutor’s Office, taking into account his age, 19 years old at the time, and his commitment to collaborate with Justice, which materialized with the recovery of 863,000 euros of the profits he obtained from the sale of stolen data.
According to the prosecutor’s account in her indictment, on October 19, 2021, Alcasec contracted with the company Cherry Servers, based in Lithuania, two massive data storage systems with an email account that she had created when she was a minor in order to hide her true identity. Subsequently, he obtained from Daniel BE, 32 years old, who was a user of Russian forums specialized in the unauthorized sale of access passwords to restricted information systems, a stolen digital certificate, issued by the National Mint and Stamp Factory for the General Directorate of Traffic (DGT).
In this way, he managed to navigate through the SARA network (System of Applications and Networks for Administrations), connect with the website of the Judicial Neutral Point (PNJ) of the CGPJ and obtain the credentials of an official from a court in Bilbao, which he used to learn about the operation of the PNJ. Alcasec and Daniel BE then created a page that pretended to be the PNJ’s access website and the first sent a text chain to different courts that redirected to it in order to obtain the passwords of other users.
After obtaining the credentials of two officials who mistakenly entered them on the fake page, Alcasec made 438,099 requests to the Tax Agency’s “extended bank accounts” web service and shortly after carried out a second attack. For the sale of data, some of relevant people, Alcasec had the uSms portal, where it entered 574,908 records extracted from the PNJ, and the transactions were made through the Plisio cryptocurrency payment gateway.
The biggest buyer was Juan Carlos O., 28 years old, who invested 109,876 euros. The intention of this accused, who had several weapons seized – a finding that is being investigated in a Dos Hermanas court – was to profit from this data. Daniel BE was convicted in 2022 for attempted murder and in 2023 for fraud, and Juan Carlos OG in 2017 for the latter crime.
