The spine of this file is a Telegram handle. That matters more than the page count: 1,014 identifier appearances reduce to 994 unique ones [3], a repetition rate of about two percent [4]. Raw exports out of a breached personnel system do not usually arrive that clean. And 994 profiles spread over 499 pages works out at roughly two per page [5], which is the footprint of a per-person template with room for a photograph and a contact block, not a spreadsheet dump with a thousand rows on twenty sheets.
The depth varies from one person to the next [16], but the format holds, and in many entries it extends past the named individual into several additional numbers listed under the heading "contacts in his address book" [10]. That is the part with the longest tail. A phone number harvested from someone else's phone stays valid whether or not its owner ever hears about this document.
What the file does not establish is who is in it. The collective titled it a listing of the Spanish security forces [6], yet some profiles state no profession or corps at all [6], and Estrella Digital is explicit that 994 counts individualised profiles rather than personnel whose membership can be verified from the contents [8]. Others in the file are labelled from the first page as members of the Spanish army, the Guardia Civil or the Cuerpo Nacional de Policia, with photograph, telephone, email, identifier and address-book contacts attached [7]. So the count officials will end up quoting is a count the publisher supplied about its own work product. The checking is being done downstream, by police unions and Guardia Civil associations who have identified some of the profiles and taken the matter to Interior [9].
On the sponsorship question, the sourcing is thinner than the file. Sources accessed by Estrella Digital say the collective inherits part of a hacker structure that previously operated linked to the GRU, Russian military intelligence, and later ran under a formally civilian arrangement [14]; sector sources cited by the same outlet place the GRU behind the group [15]. Both are unnamed and single-outlet, and nothing in a 499-page dossier set corroborates a chain of command. The on-record material is narrower and still useful: the group surfaced publicly in March 2022, weeks into the invasion of Ukraine [11], the CCN, which sits inside the CNI, has carried it in annual national-security cyberthreat reporting almost from the start of its activity [12], and the Ertzaintza's cybersecurity agency has placed it among the actors with the most attacks against Spain and other backers of Kyiv [13].
Those listings were earned by attack volume. A curated set of individual dossiers on serving personnel is a different output with a different consumer, and it does not decay the way a disruption campaign does: the traffic stops, the phone numbers do not. Estrella Digital says it also obtained a roster of people who form or have formed part of NoName057(16) [2], which is the one thread in this story that could turn attribution from sourcing into names.
