On January 26, 2019, an unauthorized attacker exploited a SQL injection vulnerability in the website of a school in Spain. The attacker gained unauthorized access to the website’s user database and compromised the personal details of 1,555 registered extranet users, including parents and staff members. The exposed personal data included names, national ID (DNI) numbers, cooperative member numbers, email addresses, and encrypted passwords.