Telefónica Hellcat infostealer-to-Jira breach (Spain, 2025)

In January 2025, the Spanish telecommunications giant Telefónica disclosed that the Hellcat ransomware group had breached its internal Jira ticketing system using credentials originally captured by infostealer malware running on the endpoints of more than 15 employees. Unusually for a 2025 incident, Hellcat did not attempt extortion — they simply published 2.3 GB of stolen data on a hacking forum.

What happened

Infostealer malware — the Lumma/Redline/Vidar lineage that has become the dominant credential-harvesting tooling across the underground — had been quietly operating on more than 15 Telefónica employee endpoints. The compromised credentials included logins for Telefónica's internal Jira ticketing system, the kind of system that holds operational tickets, customer support exchanges, and unredacted internal data.

On 8–9 January 2025, Hellcat actors authenticated to the internal Jira using the harvested credentials. They identified two Jira administrators and, in a textbook social-engineering escalation, tricked the admins into revealing the correct server for SSH access. From there they brute-forced SSH credentials and got a shell.

On 10 January, Hellcat published the haul on a hacking forum — not on a ransomware leak site, and without prior extortion attempt. The data set:

• Approximately 24,000 Telefónica employee names and email addresses.
• Approximately 470,000 internal Jira tickets.
• Approximately 5,000 internal documents in formats including CSV, PPTX, XLSX, DOCX, PDF, and MSG.
• An additional pool of customer-related ticket information running to hundreds of thousands of lines.

The "humiliation publishing" tactic — publishing rather than extorting — was a deliberate signature of Hellcat's early operations and has been replicated by other emerging crews since.

Impact

• ~24,000 employee emails exposed.
• ~470,000 internal Jira tickets exposed.
• ~5,000 internal documents exposed.
• ~236,493 lines of customer information surfaced in the dump.
• No extortion attempt — data was simply published.

Why it matters

Telefónica is the canonical European case for infostealer-to-internal-ticketing-system breaches. The chain — infostealer on personal endpoints → corporate Jira credentials → social-engineering of admins → SSH escalation → public dump — has become a template for how attackers monetise harvested credentials when targets are too large to easily extort. The choice to publish without ransom also previewed a "humiliation publishing" tactic now seen across multiple new ransomware brands.