Fluge Audiovisuales

Fluge Audiovisuales is a Spanish company and market leader in AV equipment rental (sound, lighting, video, staging) for concerts, festivals, corporate events, TV and film. It operates across Spain (Madrid, Barcelona, Bilbao, Valencia, Ibiza, Galicia)

SUMMARY

We obtained the complete file repository of Fluge Audiovisuales and its group of companies, including CROMARENT, DATOP, DISORDER, FG MICE, FG NT, SK PRODUCCIONES, STORY FESTIVALES, UNION B ZAS RENTAL, VIRUTA TEORICA, and LOULADI. The dataset contains tens of thousands of files spanning 2022 through 2026, with the heaviest concentration in 2024–2026.

The archive covers the full operational footprint of the organization: administration, production, human resources, workplace safety, and treasury. It includes scanned national identity documents, tax filings with the Spanish tax authority, payroll, supplier payment registers, medical fitness certificates, CAD drawings, and digital certificate files. Multiple administrative staff workspaces are represented in full, with their active working files, accounting spreadsheets, and email archives.

The group operates across Spain with regional divisions for Galicia, Levante, and Madrid, and handles production for concerts, festivals, trade shows, and corporate events. The dataset reflects all of this activity in granular detail.

WHAT WE HAVE

Personal Data & Identity Documents

The dataset contains several thousand files related to Spanish national identity cards (DNI), including scanned images of both front and back of cards for named technicians and freelance personnel. NIE (foreigner identity number) documents and passport scans are present in the hundreds.

Workplace safety documentation (PRL — Prevención de Riesgos Laborales) forms a substantial portion of the personal data. This includes:

Medical fitness certificates ("APTO MEDICO") for named workers

Personal protective equipment (EPI) records

Training forms and platform certifications

Technical inspection reports (ITA) for Fluge Audiovisuales

Information meeting minutes (Actas de INFO) under Article 18

Dozens of individuals are identified by full name across DNI files, PRL records, and payroll documentation. CIPA healthcare identifiers are present in the hundreds.

Financial Records

Financial documentation constitutes the largest category in the dataset. Tens of thousands of invoice files (facturas) are organized by month, subsidiary, and technician. The billing infrastructure covers all group companies and spans the full 2022–2026 period.

The dataset includes:

Tax settlement filings (liquidaciones) for IVA and IRPF — over a thousand files covering quarterly returns for every subsidiary

Treasury operations (tesoreria) with supplier payment registers organized by date and regional group

Payroll records (nominas) — over a thousand files

IBAN references — over a thousand files containing bank account identifiers

Bank guarantees (avales), promissory notes (pagarés), and leasing contracts — hundreds each

Mortgage documentation

Subsidy applications (subvenciones) and payment proofs (justificantes)

Accounting ledgers, balance sheets, and profit-and-loss statements in spreadsheet format

Audit documentation for 2025 covering lease agreements and banking arrangements

Billing reports include consolidated monthly summaries and weekly invoice registers with detailed breakdowns by production project.

Legal & Tax Compliance

Over a thousand files relate to AEAT (Agencia Estatal de Administración Tributaria) correspondence. These include tax payment certificates, census registrations, and formal resolutions. Among these, sanction imposition resolutions from AEAT are present for multiple group companies, alongside data ratification requirements and tax compliance certificates for individual technicians and entities.

Official records (actas) number over a thousand and include workplace safety information meeting minutes, CAE (Centro de Atención al Empresario) records for specific events, and compliance documentation tied to named productions.

Confidential documents are present in the hundreds.

Technical Documentation & Intellectual Property

CAD drawings in .dwg format — over a hundred files — are present, covering equipment designs, stage configurations, and technical layouts. These represent proprietary engineering work for the group's production infrastructure.

Weekly SAT (Servicio de Asistencia Técnica) rigging reports document equipment maintenance and technical operations across multiple production periods.

Digital Certificates

PKCS#12 certificate files ( .p12 ) are present in the dataset. These files typically contain private keys and digital certificates used for electronic signatures, tax filings, and system authentication.

The full scope of the dataset is understood. All materials have been reviewed and categorized.

WHO CAN RECEIVE THIS DATA

Regulators

The dataset contains personal data of identifiable individuals, including scanned identity documents, medical fitness certificates, and banking details. Under GDPR , this exposure falls within the scope of the Agencia Española de Protección de Datos (AEPD) . The presence of AEAT sanction resolutions and tax compliance documents adds a fiscal oversight dimension. Regulators can be contacted with structured evidence of the data categories present.

Individuals

Dozens of individuals are identified by full name with corresponding DNI scans, NIE documents, passport copies, medical records, and payroll data. These individuals can be notified directly that their identity documents and personal data are part of the breach. The dataset provides sufficient information to contact affected workers, freelancers, and administrative staff.

Competitors

The dataset includes pricing structures, budget documents (presupuestos), supplier payment registers, consolidated billing reports, and CAD drawings of technical infrastructure. Competitors in the audiovisual production and events industry can use this data to understand Fluge's pricing, supplier relationships, regional operations, and technical capabilities. Production project details, including event-specific staffing and equipment allocations, are present across multiple years.

WHAT CAN HAPPEN

Identity documents (DNI, NIE, passports) can be used for identity fraud, account takeover, and social engineering targeting named individuals

IBAN data and banking references can enable financial fraud and targeted phishing campaigns with verified personal details

Tax settlement filings and AEAT correspondence can expose the group's fiscal position and compliance history to interested parties

Medical fitness certificates and CIPA identifiers can be distributed, exposing health-related personal data of workers

Digital certificate files ( .p12 ) may provide access to electronic signature systems used for tax filings and official communications

CAD drawings and technical documentation can be shared with competitors or published, undermining proprietary engineering work

Payroll data and supplier payment registers can be used to map the group's cost structure and business relationships

Sanction resolutions from AEAT can be published, drawing regulatory and media attention to the group's compliance history

The full archive can be indexed and made searchable, ensuring that this data surfaces during due diligence and background checks for years

Once distributed, this dataset can be repackaged and traded among independent actors — fraud groups, identity thieves, competitors, and other threat actors — who can use it without any connection to the original breach