#Hacktivity2024 // How to steal 10 million euro using OSINT

Responsible Disclosure Context

A Spanish researcher describes ethically reporting flaws in municipal voucher platforms subsidizing local spending. After earlier cases, a regional government scaled a discount-voucher program requiring national ID numbers at payment—implemented, he believes, by the same vendor with weak controls.

Weak Identity Checks

The vendor added date-of-birth checks and SMS confirmation, but the same phone could be reused and public records could supply DOB. The CEO engaged openly, yet argued the short-lived system did not warrant stronger identity proofing like disposable SIM rules or digital certificates.

OSINT and Public Data Risk

The speaker warns national ID numbers are no longer secret when public portals leak PII—disability status, criminal records, and more discoverable via Google dorks on PDFs and spreadsheets. Municipalities, banks, and vendors blamed each other when issues surfaced.

Realistic Fraud Math

Stealing ten million euros is clickbait; mass fraud needs every ID in a city and would draw police attention. Still, hundreds of unclaimed vouchers could be abused on day one using leaked databases, dark-web identity markets, or insider database access—manual but feasible.