Not legal at all, like in the rest of the European Union. Just publishing this information will make the consultancy send a notification to the Spanish Data Protection Agency, and will cost them money.

He did not disclose the company name (but easy to guess if you work on IT in Spain), so I don’t think he could have legal issues because of the post.

But, the cyber security professionals working in the consultancy firm can gather easily the small pieces of information left behind and sue him if they find out data extraction, for example.

Keep in mind that he claims he extracted sensitive data, but he could be lying just to be in the HN front page. Who knows.

Unethical, risky… and very stupid.

tbh, not too legal anywhere.