- Cyberattacks in Spain are growing rapidly, particularly affecting SMEs, and have an average cost per incident of around 35.000 euros, with a high risk of business closure.
- The most common threats are malware, ransomware and phishing, which are becoming increasingly sophisticated and supported by cybercrime-as-a-service models and the malicious use of artificial intelligence.
- Supply chains and external suppliers have become the preferred entry point for attacking large corporations and critical sectors.
- The legal framework (GDPR, NIS2) and the reputational impact force companies and administrations to integrate cybersecurity into their strategy, reinforcing technology, processes and training.
In recent years, Spain has become a prime target for cybercrime . Businesses, public administrations, and industrial infrastructure suffer daily attacks that go far beyond a simple computer virus: we're talking about massive data thefts, multi-million dollar blackmail, sabotage of essential services, and information leaks that end up on the dark web.
This scenario has a direct impact on the economy and daily life. Small and medium-sized businesses are closing, citizens' personal data is being exposed , local councils are left without systems to serve the public, and major companies listed on the IBEX 35 are facing breaches that damage their reputation. All of this is happening in a context where digitalization, artificial intelligence, and remote work have multiplied the entry points for attackers.
The problem of cyberattacks in Spain: worrying figures
Digitalization has become essential for Spanish businesses , but it has also opened a huge door to cybercrime. Telecommunications, the cloud, e-commerce, and remote work are now at the heart of economic activity, and any security breach translates almost immediately into financial losses, business disruptions, and legal penalties.
According to the latest data from INCIBE, approximately 97.000 cybersecurity incidents were handled in Spain alone in 2024, representing an increase of roughly 16,6% compared to the previous year. A significant portion of these incidents directly affected businesses, including essential service providers and SMEs, which have become a prime target for many criminal groups.
The rise of remote work hasn't helped to contain the problem either. Around three million people work remotely in Spain , using personal computers, home networks, and mobile devices that, in many cases, lack the same security guarantees as corporate environments. This situation has dramatically increased the risks of intrusion, credential theft, and phishing attacks targeting employees.
Looking at the financial impact, it's devastating: the estimated average cost of a cyberattack for a Spanish company is around €35.000 . But that average is misleading, because for an SME, that amount can mean the difference between staying open and closing down. In fact, several studies indicate that around 60% of small and medium-sized enterprises close within six months of suffering a serious cybersecurity incident.
In addition to the direct costs (business interruption, system recovery, hiring experts, etc.), companies must also face regulatory risk . Since the General Data Protection Regulation (GDPR) came into effect, personal data breaches can result in multimillion-euro fines. In 2024 alone, European authorities imposed penalties of over €1.200 billion for privacy and security violations.
An increasingly sophisticated threat: malware, Phishing and ransomware
The range of techniques used by cybercriminals in Spain is as varied as it is worrying . From simple email scams to complex blackmail operations, massive data theft, and SQL injection , the sophistication of attacks has grown in tandem with the increasing digital dependence of businesses and government agencies.
Malware remains the most prevalent type of threat . Recent reports document over 42.000 cases of viruses, Trojans, and other malicious programs capable of infecting computers, spying on users, deleting data, or opening backdoors for future attacks. Within this group, ransomware has established itself as the most disruptive threat , combining data encryption, information theft, and double or even triple extortion tactics.
Phishing has skyrocketed in Spain . Tens of thousands of incidents are reported each year, with campaigns using fake websites, calls , and emails that impersonate banks, government agencies, or major brands. In many cases, the goal is to obtain passwords, banking details, or corporate credentials. It's striking that more than two-thirds of the phishing domains detected in Spain use HTTPS, creating a false sense of security among users who associate the browser's padlock icon with trustworthiness.
Meanwhile, distributed denial-of-service (DDoS) attacks are also on the rise , with tens of thousands of attempts recorded in a single year. This type of attack involves overwhelming servers or online services to disable them, affecting corporate websites, public portals, and critical services.
Beyond the statistics, experts point to a fundamental shift: the professionalization of cybercrime and the emergence of "cybercrime as a service." Today, any criminal with limited technical knowledge can rent ransomware kits, purchase stolen access credentials, or hire specialized groups to run phishing campaigns , with an estimated return on investment of over 1.400%, far exceeding that of drug trafficking.
Spain in the spotlight: ransomware and massive offensives
Spain's position on the global cyberattack map is far from comfortable . Several reports place it among the European countries most affected by cybercrime, with an average of almost 2.000 attacks per week per organization during the first quarter of 2025. This represents a growth of around 60% compared to the previous year.
Ransomware has grown at an especially aggressive rate . While globally attacks of this type increased by just over 100%, in Spain the increase has been close to 150%. Known incidents went from a few dozen to more than a hundred in a single year, accounting for a significant portion of all such attacks detected worldwide.
Behind these campaigns are not isolated amateurs, but rather genuine criminal organizations with a business structure . Models like Ransomware as a Service (RaaS) allow one group to develop the infrastructure and malware, while other "affiliates" execute the attacks and share the profits. Names like RansomHub, Akira, and Clop have made headlines for their attacks targeting companies, supply chains, and service providers.
The tactics have also become more sophisticated. Simple file encryption is no longer enough . Now, it's common for attackers to first steal large volumes of data and, after encrypting the systems, demand a ransom twice: once to regain access and again to prevent the publication of the stolen information. In the most extreme cases, they even resort to triple extortion, also pressuring the victim's clients or patients, especially if the data is medical or other highly sensitive.
Meanwhile, Spain is experiencing a notable increase in politically or strategically motivated cyberattacks . Pro-Russian groups have claimed responsibility for denial-of-service attacks against the websites of provincial councils, city halls, and public bodies, particularly in response to the Spanish government's support for certain international partners. This reflects a growing convergence between organized cybercrime and actors linked to states such as Russia, China, North Korea, and Iran.
Cyberattacks in Spain: recent cases that set trends
The list of recent incidents in Spain shows that no one is safe : universities, insurance companies, large stores, city councils, water companies, telecommunications operators or even chambers of political representation have suffered attacks with greater or lesser impact.
In early 2025, a public university in the Balearic Islands was targeted by a phishing campaign that impersonated the institution itself. The attacks used emails containing links to fake websites designed to steal credentials from students and faculty. While the full extent of the incident was not made public, the case highlighted how easily attackers can exploit trust in institutional email.
Shortly afterward, it was revealed that the data of approximately 180.000 members of the Civil Guard, the Armed Forces, and the Ministry of Defense had been leaked and put up for sale on cybercrime forums. The exposed information included email addresses, many of them personal, opening the door to future targeted extortion or espionage campaigns.
In the corporate sphere, Telefónica has been the subject of several significant breaches . First, an incident in its internal ticketing system exposed gigabytes of information related to the management of technical incidents. Later, a suspected massive hack of its communications services allegedly compromised millions of customer records, including data from users in other countries, in exchange for a relatively modest ransom demanded by the attacker.
Other major Spanish brands have also been affected. A leading health insurer notified its clients of unauthorized access to personal information such as names, phone numbers, addresses, and emails, although the leak of medical or financial data was ruled out. Similarly, a well-known department store chain suffered an attack through one of its suppliers , which exposed loyalty card and contact information for millions of users.
Local government is also under constant attack. City councils like Badajoz have seen their digital services paralyzed by ransomware attacks , which rendered appointment booking portals, administrative procedures, and internal systems inoperable for days. Municipal companies like the Mataró water utility have also had to manage incidents that, while not affecting the water supply, did compromise technological operations and customer service.
Even the Senate has been embroiled in a unique case when two internal IT staff members gained unauthorized access to the digital accounts and profiles of several senators , leading to their disciplinary dismissal. The incident highlighted the risks posed by poorly managed privileged access within any organization.
The impact on SMEs and the business fabric: the weakest link
The perception that only large corporations are targeted by cyberattacks is a dangerous myth . In Spain, small and medium-sized enterprises (SMEs) are the backbone of the economy and, at the same time, the most profitable target for many cybercriminals.
Reports from operators and public bodies agree: incidents affecting businesses have skyrocketed, growing by more than 40% in a single year , with tens of thousands of cases handled. A growing proportion of these incidents involve SMEs that provide critical services or act as suppliers for large corporations, making them a highly attractive link in the supply chain.
One reason is that SMEs typically have fewer resources and less specialized staff . Technology management often falls to external providers or small teams, without a formal cybersecurity strategy or clear policies for training, backups, or vulnerability management. This is compounded by a dangerous feeling of "it won't happen to me because I'm small."
The result is that the consequences of an attack on an SME can be devastating . In addition to the estimated average cost of €35.000 per incident, one must consider losses from production downtime, order cancellations, loss of customers, penalties for data exposure, and reputational damage. It is no coincidence that around six out of ten affected small businesses end up closing their doors within six months.
The rise in digital fraud is also a cause for concern. Certain sectors, such as online communities, gaming, and financial services, report losses equivalent to almost 8% of their annual revenue due to scams and cyberattacks—a percentage that has grown significantly compared to the previous year. For many companies, this level of loss represents a direct blow to their viability.
Supply chains: the Achilles' heel of large corporations
One of the most dangerous trends that has taken hold in Spain is the attack on suppliers and third parties to gain backdoor access to large corporations. Instead of directly attempting to breach the systems of a bank, energy company, or airline, cybercriminals compromise a service company with weaker defenses and use its credentials or connections to reach the "big target."
In recent years, incidents affecting Iberia, Iberdrola, Banco Santander, and Repsol have originated from security breaches by external providers . Contact centers, marketing companies, technical support services, and cloud platforms have become the ideal way to access data from hundreds of thousands or even millions of end customers.
This approach has a simple logic: attackers seek to maximize their return with minimal effort . Compromising a single vendor with access to multiple customers allows them to scale the impact and multiply the value of the stolen data. Furthermore, vendors often possess credentials with privileges similar to those of internal employees, making lateral movement within networks even easier.
A telling example is the case of a well-known British department store chain, which saw criminals impersonate employees of a supplier's IT staff , successfully changing passwords and restoring access. The attack forced the closure of part of the online business for weeks and resulted in losses of hundreds of millions of euros, demonstrating the extent to which a supply chain incident can impact the bottom line.
In response to this reality, regulations such as the European Union's NIS2 directive have tightened requirements for third-party risk management . Sectors like energy, transportation, banking, and healthcare must much more rigorously assess and control how their suppliers manage data and what security measures they implement. Simply relying on a contract is no longer sufficient: continuous monitoring, audits, and clear liability clauses are now essential.
The role of artificial intelligence: both ally and threat
The emergence of artificial intelligence (AI) has radically changed the landscape of cyberattacks in Spain . On the one hand, it has provided defenders with powerful tools to detect anomalous behavior, automate responses, and anticipate vulnerabilities. But on the other hand, it has also fallen into the hands of malicious actors who use it to escalate and refine their attacks.
On the dark side, AI is used to generate far more convincing phishing campaigns , with personalized emails, flawless text, and fraudulent websites almost indistinguishable from the real thing. Many modern malware variants incorporate algorithms capable of adapting their behavior to evade traditional detection systems, changing patterns, routes, or encryption methods on the fly.
Furthermore, the automated creation of fake content has led to a surge in the number of fraudulent news sites and disinformation campaigns . Thousands of AI-generated pages have been identified that publish misleading articles every few minutes, making it extremely difficult for the average citizen to distinguish reliable information from elaborate hoaxes.
Deepfakes are also gaining traction as a fraud tool . Voice or image cloning of executives and public figures allows for the creation of extremely convincing scams, such as requests for urgent transfers or the sending of sensitive documents. For many companies, these types of deceptions are very difficult to detect without additional internal verification controls.
Given this scenario, experts agree that defense cannot abandon AI, but rather must integrate it thoughtfully . Advanced detection and response solutions, continuous monitoring, and behavioral analysis are essential to cope with a volume of attacks that can no longer be handled by human oversight alone. However, they emphasize the need to combine these systems with experts who oversee decisions, mitigate biases, and protect the models themselves against manipulation attempts.
Industrial infrastructure and critical sectors: a silent risk
Beyond offices and websites, Spanish industrial infrastructure is also under the scrutiny of cybercriminals . Plant control systems, building automation, energy networks, and water services are part of a particularly vulnerable area: a successful attack can result in physical disruptions, material damage, and risks to the population.
In Southern Europe, which includes Spain, almost one in five computers in industrial control systems has had to block cyberattack attempts in a single quarter . In Spain, the proportion is close to this regional average, indicating constant pressure on OT (Operational Technology) infrastructures and production environments.
By sector, biometrics and building automation are among the hardest hit , with the percentage of systems attacked above the global average. In contrast, areas such as construction, industrial engineering, and manufacturing are currently registering somewhat lower figures, although they remain exposed to significant risks.
The main entry points into these environments are the internet and email . A significant percentage of industrial computers have had to block attacks arriving via the network or email messages, demonstrating that traditional attack vectors also affect control systems. The use of USB drives and other removable devices poses a smaller, but not negligible, risk.
Particularly worrying is the prevalence of spyware in these industrial environments . In Spain, over 7% of ICS systems have suffered attempted infections with this type of malware, designed to steal confidential information, move within the network, and, if necessary, download other threats such as ransomware. For critical infrastructure, this type of intrusion can be the prelude to much more serious incidents.
Experts recommend, among other measures, regular security assessments of OT systems, continuous vulnerability management, updates to key components , and the deployment of advanced detection and response solutions specifically designed for industrial environments. Joint training of IT and operations personnel is considered crucial for improving prevention and response capabilities.
Legal framework, reputational risk and corporate responsibility
The impact of cyberattacks in Spain is not measured solely in euros or the number of infected devices . It also has a profound legal, regulatory, and reputational dimension. The combination of the GDPR, the NIS2 directive, and other sector-specific regulations, such as ISO 27001 , compels companies and organizations to treat cybersecurity as a strategic issue.
When an incident involves personal data, the organization must notify the relevant authorities and, in many cases, the data subjects themselves . An unjustified delay or a lack of transparency can lead to significant financial penalties, as well as damage to trust that is difficult to repair. In sectors such as finance and healthcare, this trust is practically the brand's most valuable asset.
Furthermore, paying a ransom in a ransomware attack raises serious legal and ethical concerns . There is a risk of committing crimes related to collaborating with criminal organizations, financing illicit activities, or even money laundering. And, in practice, there is no guarantee that the attackers will keep their word or that they won't target the same victim again later.
In this context, companies have a clear responsibility for prevention, protection, and response . This involves investing in appropriate technological solutions, but also training employees, defining security policies, establishing contingency plans, and actively collaborating with other organizations, suppliers, and public bodies to share information about threats.
The reality of daily life shows that 80% of incidents originate from human error : weak passwords, impulsive clicks on malicious emails, unchecked logins, or incorrect configurations. Therefore, beyond technology, a company's security culture is probably the most decisive factor in reducing actual risk.
As the Spanish economy deepens its digital transformation, cybersecurity has become a central component of business continuity . Attacks will continue to grow in volume and sophistication, criminal groups will continue to professionalize, and regulatory obligations will become increasingly demanding. In this scenario, integrating security into strategy, protecting the supply chain, leveraging artificial intelligence responsibly, and strengthening internal training are no longer optional, but essential for continued operation in an environment where the next cyberattack is not a distant possibility, but a matter of time.