Suspected Anonymous members detained in Spain over post-flood DDoS blitz
The Register
February 23, 2026
AI-Generated Deep Dive Summary
Spanish police have detained four individuals claiming affiliation with the hacktivist group Anonymous Fénix, suspected of carrying out DDoS attacks on government institutions following the 2024 DANA floods. The arrests occurred in Ibiza, Móstoles, Madrid, Alcalá de Henares, and Oviedo, marking a significant escalation in law enforcement efforts against cyberactivists linked to the disaster. The suspects allegedly targeted public websites, including government ministries and political parties, claiming these institutions were responsible for the flood tragedy.
The group, which emerged as an Anonymous offshoot in 2023, primarily operated on platforms like X and Telegram, using them to recruit members and promote hacktivist activities. Despite their online presence, their following was relatively small—fewer than 700 followers on X and only a handful of subscribers on Telegram. However, the scale of their DDoS attacks was significant enough to disrupt several government websites, with officials confirming multiple successful attempts.
The case highlights the ongoing challenges posed by hacktivist groups, even as their influence wanes compared to their peak in the early 2010s. While Anonymous Fénix was not a large operation, its activities underscore the potential risks of cyberattacks targeting public institutions during times of crisis. The arrests also mark a broader trend of law enforcement cracking down on anonymous online groups linked to political or social activism.
This story matters to tech readers as it sheds light on the evolving landscape of hacktivism and cybersecurity threats. It raises questions about the role of online platforms in facilitating such activities and the challenges faced by governments in addressing cyberattacks, particularly during natural disasters or other sensitive events.
The detention of these individuals and the subsequent takedown of their social media accounts signal a coordinated effort to disrupt groups that exploit digital spaces for political protests. As cyberattacks become more sophisticated, understanding the motivations behind such actions and the measures taken to counter them remains critical for both tech professionals and the general public.
Verticals
tech
Originally published on The Register on 2/23/2026