Spain — Cyber Threat Profile
Spain's 2026 posture is defined by the finalization of the NIS2 Directive transposition and the reinforcement of the National Security Framework (ENS). The National Cybersecurity Institute (INCIBE) has expanded its support for SMEs, providing "Cybersecurity Kits" to harden the nation's economic backbone. Spain is also a key player in the EU's "Report Once" initiative, streamlining incident notification across various regulatory bodies. Strategic focus areas include securing the tourism and renewable energy sectors, which are frequent targets of ransomware. The government is also investing heavily in the "Cybersecurity Innovation Hub," aiming to foster a domestic industry capable of meeting global defense standards.- National CERT/CSIRT: INCIBE-CERT
- Data protection authority: Agencia de Protección de Datos (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 0.27 / 100, #66 worldwide
- Secure Internet servers per 1M people (2024): 29,986.4 (source: World Bank)
- Internet users (2024): 95.8% of population (source: World Bank)
Latest Spain coverage
- Fake streaming ads on Meta and TikTok hijack Android phones 2026-09-03 · Cyber Incidents
Threat actors targeting Spain
- APT41 APT
- Lazarus Group APT
- NoName057(16) Hacktivist
- Qilin Ransomware · 65 incident(s)
- LockBit Ransomware · 28 incident(s)
- RansomHub Ransomware · 19 incident(s)
- Akira Ransomware · 18 incident(s)
- Deadlock Ransomware · 15 incident(s)
- SafePay Ransomware · 15 incident(s)
- INC Ransom Ransomware · 10 incident(s)
- Hunters International Ransomware · 9 incident(s)
- NightSpire Ransomware · 9 incident(s)
- The Gentlemen Ransomware · 9 incident(s)
- Lynx Ransomware Ransomware · 7 incident(s)
- 8Base Ransomware · 6 incident(s)
- DragonForce Ransomware · 6 incident(s)
- FunkSec Ransomware · 6 incident(s)
- Stormous Hacktivist · 6 incident(s)
- Cactus Ransomware · 5 incident(s)
- Gunra Ransomware · 5 incident(s)
- RansomHouse Ransomware · 5 incident(s)
- BlackSuit Ransomware · 4 incident(s)
- Fog Ransomware Ransomware · 4 incident(s)
- Krybit Ransomware · 4 incident(s)
- Sarcoma Ransomware · 4 incident(s)
- Cl0p Ransomware · 3 incident(s)
- M3rx Ransomware · 3 incident(s)
- Medusa Ransomware Ransomware · 3 incident(s)
- Meow Ransomware · 3 incident(s)
- ALPHV/BlackCat Ransomware · 2 incident(s)
- Booba Project Ransomware · 2 incident(s)
- Brain Cipher Ransomware · 2 incident(s)
- Coinbase Cartel Ransomware · 2 incident(s)
- Dire Wolf Ransomware · 2 incident(s)
- Kairos Ransomware · 2 incident(s)
- Nova Ransomware · 2 incident(s)
- Trigona Ransomware · 2 incident(s)
- AiLock Ransomware · 1 incident(s)
- APT73 Ransomware · 1 incident(s)
- Beast Ransomware · 1 incident(s)
Most targeted sectors
- Business & Professional Services 58 incident(s)
- Manufacturing 49 incident(s)
- Technology 40 incident(s)
- Agriculture & Food 34 incident(s)
- Hospitality & Tourism 19 incident(s)
- Healthcare 17 incident(s)
- Retail & Consumer 16 incident(s)
- Transportation & Logistics 11 incident(s)
- Government & Public Sector 10 incident(s)
- Financial Services 9 incident(s)
- Energy & Utilities 8 incident(s)
- Construction 6 incident(s)
Recent claimed incidents
- gayafores.es 2026-09-08 · Agriculture and Food Production
- gsngestion.es 2026-09-08 · Professional Services
- Jbc 2026-09-07
- Asfaltos y Pavimentos S.A. (Asfalpasa) 2026-09-02 · Manufacturing
- icot.es 2026-08-31 · Technology
- syc.es 2026-08-31 · Technology
- Alter Consultores Legales 2026-08-28 · Professional Services
- TEC Container 2026-08-26 · Manufacturing
- FRUCASTRO SL 2026-08-23 · Agriculture and Food Production
- Ayuntamiento de Velilla de San Antonio 2026-08-20 · Government & Defense
- Semana 2026-08-19 · Other
- Castilla La Mancha 2026-08-17 · Government & Defense
- Tecnologías de Código Abierto S.L., trading as Tecnoabi, 2026-08-14 · Technology
- Aletex Group 2026-08-14 · Manufacturing
- granjarinya.com 2026-08-14 · Agriculture and Food Production