Spain — Cyber Threat Profile
Spain's 2026 posture is defined by the finalization of the NIS2 Directive transposition and the reinforcement of the National Security Framework (ENS). The National Cybersecurity Institute (INCIBE) has expanded its support for SMEs, providing "Cybersecurity Kits" to harden the nation's economic backbone. Spain is also a key player in the EU's "Report Once" initiative, streamlining incident notification across various regulatory bodies. Strategic focus areas include securing the tourism and renewable energy sectors, which are frequent targets of ransomware. The government is also investing heavily in the "Cybersecurity Innovation Hub," aiming to foster a domestic industry capable of meeting global defense standards.- National CERT/CSIRT: INCIBE-CERT
- Data protection authority: Agencia de Protección de Datos (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 0.27 / 100, #66 worldwide
- Secure Internet servers per 1M people (2024): 29,986.4 (source: World Bank)
- Internet users (2024): 95.8% of population (source: World Bank)
Latest Spain coverage
- Spain's national weather agency lands on a leak site 2026-09-11 · Ransomware
- Fake streaming ads on Meta and TikTok hijack Android phones 2026-09-03 · Cyber Incidents
Threat actors targeting Spain
- APT28 APT
- APT41 APT
- Lazarus Group APT
- NoName057(16) Hacktivist
- Qilin Ransomware · 77 incident(s)
- LockBit Ransomware · 29 incident(s)
- RansomHub Ransomware · 19 incident(s)
- Akira Ransomware · 18 incident(s)
- Deadlock Ransomware · 16 incident(s)
- SafePay Ransomware · 16 incident(s)
- The Gentlemen Ransomware · 14 incident(s)
- INC Ransom Ransomware · 11 incident(s)
- NightSpire Ransomware · 10 incident(s)
- Hunters International Ransomware · 9 incident(s)
- Lynx Ransomware Ransomware · 7 incident(s)
- 8Base Ransomware · 6 incident(s)
- DragonForce Ransomware · 6 incident(s)
- FunkSec Ransomware · 6 incident(s)
- Stormous Hacktivist · 6 incident(s)
- Cactus Ransomware · 5 incident(s)
- Gunra Ransomware · 5 incident(s)
- RansomHouse Ransomware · 5 incident(s)
- BlackSuit Ransomware · 4 incident(s)
- Fog Ransomware Ransomware · 4 incident(s)
- Krybit Ransomware · 4 incident(s)
- Sarcoma Ransomware · 4 incident(s)
- Cl0p Ransomware · 3 incident(s)
- Lamashtu Ransomware · 3 incident(s)
- M3rx Ransomware · 3 incident(s)
- Medusa Ransomware Ransomware · 3 incident(s)
- Meow Ransomware · 3 incident(s)
- ALPHV/BlackCat Ransomware · 2 incident(s)
- Booba Project Ransomware · 2 incident(s)
- Brain Cipher Ransomware · 2 incident(s)
- Coinbase Cartel Ransomware · 2 incident(s)
- Dire Wolf Ransomware · 2 incident(s)
- Kairos Ransomware · 2 incident(s)
- MedusaLocker Ransomware · 2 incident(s)
- N0n Ransomware · 2 incident(s)
- Nova Ransomware · 2 incident(s)
Most targeted sectors
- Business & Professional Services 60 incident(s)
- Manufacturing 54 incident(s)
- Technology 42 incident(s)
- Agriculture & Food 36 incident(s)
- Healthcare 21 incident(s)
- Hospitality & Tourism 21 incident(s)
- Retail & Consumer 17 incident(s)
- Transportation & Logistics 15 incident(s)
- Government & Public Sector 12 incident(s)
- Energy & Utilities 9 incident(s)
- Financial Services 9 incident(s)
- Construction 6 incident(s)
Recent claimed incidents
- zelsior.es 2026-10-23
- Miljaus Producciones S.L (www.miljaus.com) 2026-10-23 · Other
- Company #110 2026-10-23
- Toyota Canarias 2026-10-19 · Transportation
- SBI Audiovisual Medinbox 2026-10-16 · Healthcare
- Segres Systec 2026-10-15 · Technology
- Estrategias BigMat S.L.U. 2026-10-14 · Retail & E-Commerce
- TTI Algeciras (container terminal operations) 2026-10-12 · Transportation
- Prodiel 2026-10-12 · Energy & Utilities
- Medcom Tech Information 2026-10-09 · Healthcare
- idi pharma 2026-10-09 · Healthcare
- EPTISA 2026-10-07 · Professional Services
- Matadero Frigorífico Avinyó 2026-10-07 · Agriculture and Food Production
- Fluge Audiovisuales 2026-10-05 · Other
- TRANS LOGROÑO SOCIEDAD ANONIMA 2026-10-05 · Transportation