Note that the actions weren't by the US Intelligence Community but by a private proxy. Frankly, I was expecting an Israeli firm, not a Spanish one.

Now replace "security firm" with Facebook, or similar.