Two Men Allegedly Created and Distributed Purportedly AI-Generated Sexual Images of 22 Women in Silleda, Galicia

Spain's Guardia Civil identified two men in connection with purportedly AI-generated sexual images depicting 22 women from Silleda, Galicia. Investigators said photographs taken from the women's social media profiles were altered to portray them nude or in sexual scenes; a 35-year-old allegedly created the material and a 29-year-old allegedly distributed it online. Victims began filing complaints in June 2026.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrators used AI deepfake tools to target specific victims for personal harassment and humiliation, creating explicit sexual imagery of them without consent.

Additional risk subdomains

• 1.2 Exposure to toxic content: The incident involved the creation and distribution of explicit, non-consensual sexual content, exposing victims and others to toxic material.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by the intentional actions of human perpetrators who used deployed AI tools to create and distribute non-consensual explicit images.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI Act classifies AI-generated content such as deepfakes under Limited Risk, which imposes specific transparency obligations to ensure users are aware the content is AI-generated.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Image Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Synthetic media generation technology developers, Synthetic image generation technology developers, Deepfake technology developers
• Alleged deployer: Unnamed 35-year-old Silleda man accused of creating AI-generated sexual images, Unnamed 29-year-old man accused of distributing AI-generated sexual images of women in Silleda, Synthetic media creators, Deepfake creators
• Alleged harmed parties: Women Minors Victims of non-consensual deepfakes, Women, Victims of deepfake abuse, Privacy, General public of Spain, General public of Silleda, Galicia, General public, Epistemic integrity, 22 women depicted in alleged Silleda AI-generated sexual images

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, the reports describe the creation and distribution of explicit, non-consensual deepfake images.

Directly caused: Two men created and distributed explicit, non-consensual deepfake images of 22 women.

Inferred additional harm: The explicit images may have been further circulated online beyond the initial platforms, potentially exposing them to a wider audience.

Civil rights

Reported: Yes, the Guardia Civil noted that the creation or diffusion of manipulated intimate images without authorization constitutes a grave violation of the affected persons' rights.

Directly caused: The rights to privacy, moral integrity, and self-image of 22 women were violated by the unauthorized creation of explicit deepfakes.

Privacy

Reported: Yes, the reports mention that the perpetrators scraped photos from the victims' social media profiles to generate the deepfakes, and the Guardia Civil advised reviewing privacy settings.

Directly caused: The perpetrators accessed and used the victims' social media photos without consent to generate explicit deepfakes.

Psychological

Reported: Yes, the reports mention a crime against moral integrity, which implies psychological distress and humiliation for the victims.

Indirectly caused: The 22 victims suffered distress, anxiety, and humiliation due to the non-consensual creation and distribution of explicit deepfakes of themselves.

Inferred additional harm: It is highly likely that all 22 victims experienced significant psychological trauma, anxiety, and social distress, though specific clinical details are not quantified in the reports.

Epistemic

Reported: Yes, the reports describe the creation of false, realistic-looking images (deepfakes) depicting the victims naked.

Directly caused: Deepfake technology was used to generate realistic but entirely fabricated images of 22 women.

People affected

• Occurrences reported: 1
• People reportedly harmed: 22
• People reportedly exposed: 22

Potential causes

Management

• Weak App Safety Controls: AI developers failed to restrict their models from generating nude outputs.

Technology

• AI Deepfake Applications: AI tools allowed easy creation of realistic nude images from normal photos.
• Lack of Platform Filters: Messaging platforms failed to automatically detect and block deepfake content.

Data Inputs

• Public Social Media Photos: Victims' photos were harvested directly from public social media profiles.

Human Factors

• Malicious Intent of Creators: Perpetrators deliberately generated and shared non-consensual sexual content.
• Low Privacy Configuration: Victims did not restrict public access to their personal profile pictures.

Process and Methods

• No Consent Verification: AI apps did not verify user consent before modifying uploaded facial images.
• Rapid Digital Distribution: Messaging networks facilitated immediate sharing of the generated images.

Regulatory Environment

• Weak Legal Safeguards: Insufficient preemptive regulations on the misuse of AI deepfake platforms.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple Spanish news outlets consistently detail the incident, including the number of victims (22), the location (Silleda), the age group of the victims (20-30), the arrest/identification of the two suspects, and the technology used (deepfake AI apps scraping social media). There is minimal ambiguity regarding the core facts.
• Ambiguities identified: The specific AI applications used to generate the deepfakes are not named.
• Alternative interpretations: None. The facts clearly point to a targeted non-consensual deepfake harassment incident.

Two individuals in Spain used AI deepfake tools to create and distribute non-consensual explicit images of 22 women. While representing a severe violation of individual privacy and human rights, the incident remains a localized criminal matter managed by domestic law enforcement with negligible direct implications for national security.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Spain
• Alleged perpetrator: Two residents of Silleda, Spain

Threat characteristics

• Imminence: Long-term. The immediate threat is resolved as suspects have been identified by law enforcement, representing an ongoing societal challenge rather than an active national security crisis.
• Autonomy: Human-controlled. The AI was used purely as a tool under direct human control to generate specific manipulated images.
• Novelty: Established threat. The creation of non-consensual deepfakes using scraped social media photos is an established threat with numerous prior precedents.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or kinetic weapons were involved or impacted in this incident.
• Information security: Negligible. The incident was a localized cyber-harassment case and did not involve state-sponsored disinformation or intelligence compromise.
• Sovereignty: Negligible. No impact on state authority, electoral systems, or government decision-making functions.
• Economic security: Negligible. No strategic technology theft, financial system disruption, or economic warfare occurred.
• Societal stability: Minor. Constitutes a serious violation of privacy and human rights for the 22 victims, but the impact is localized and managed by standard law enforcement.