Spain — Cyber Threat Profile
Spain's 2026 posture is defined by the finalization of the NIS2 Directive transposition and the reinforcement of the National Security Framework (ENS). The National Cybersecurity Institute (INCIBE) has expanded its support for SMEs, providing "Cybersecurity Kits" to harden the nation's economic backbone. Spain is also a key player in the EU's "Report Once" initiative, streamlining incident notification across various regulatory bodies. Strategic focus areas include securing the tourism and renewable energy sectors, which are frequent targets of ransomware. The government is also investing heavily in the "Cybersecurity Innovation Hub," aiming to foster a domestic industry capable of meeting global defense standards.- National CERT/CSIRT: INCIBE-CERT
- Data protection authority: Agencia de Protección de Datos (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 0.27 / 100, #66 worldwide
- Secure Internet servers per 1M people (2024): 29,986.4 (source: World Bank)
- Internet users (2024): 95.8% of population (source: World Bank)
Threat actors targeting Spain
- APT41 APT
- Lazarus Group APT
- NoName057(16) Hacktivist
- Qilin Ransomware · 62 incident(s)
- LockBit Ransomware · 26 incident(s)
- Akira Ransomware · 19 incident(s)
- RansomHub Ransomware · 19 incident(s)
- SafePay Ransomware · 13 incident(s)
- Deadlock Ransomware · 10 incident(s)
- Hunters International Ransomware · 9 incident(s)
- INC Ransom Ransomware · 9 incident(s)
- NightSpire Ransomware · 9 incident(s)
- The Gentlemen Ransomware · 9 incident(s)
- Stormous Hacktivist · 7 incident(s)
- 8Base Ransomware · 6 incident(s)
- DragonForce Ransomware · 6 incident(s)
- FunkSec Ransomware · 6 incident(s)
- Lynx Ransomware Ransomware · 6 incident(s)
- Cactus Ransomware · 5 incident(s)
- Gunra Ransomware · 5 incident(s)
- RansomHouse Ransomware · 5 incident(s)
- BlackSuit Ransomware · 4 incident(s)
- Fog Ransomware Ransomware · 4 incident(s)
- Krybit Ransomware · 4 incident(s)
- Sarcoma Ransomware · 4 incident(s)
- Cl0p Ransomware · 3 incident(s)
- Medusa Ransomware Ransomware · 3 incident(s)
- Meow Ransomware · 3 incident(s)
- ALPHV/BlackCat Ransomware · 2 incident(s)
- Booba Project Ransomware · 2 incident(s)
- Coinbase Cartel Ransomware · 2 incident(s)
- Dire Wolf Ransomware · 2 incident(s)
- M3rx Ransomware · 2 incident(s)
- Nova Ransomware · 2 incident(s)
- Trigona Ransomware · 2 incident(s)
- AiLock Ransomware · 1 incident(s)
- ALP-001 Ransomware · 1 incident(s)
- Beast Ransomware · 1 incident(s)
- Black Basta Ransomware · 1 incident(s)
- BlackByte Ransomware · 1 incident(s)
Most targeted sectors
- Business & Professional Services 45 incident(s)
- Manufacturing 35 incident(s)
- Technology 35 incident(s)
- Agriculture & Food 22 incident(s)
- Hospitality & Tourism 20 incident(s)
- Healthcare 16 incident(s)
- Retail & Consumer 11 incident(s)
- Transportation & Logistics 11 incident(s)
- Financial Services 7 incident(s)
- Government & Public Sector 7 incident(s)
- Energy & Utilities 6 incident(s)
- Construction 4 incident(s)
Recent claimed incidents
- Castilla La Mancha 2026-08-17 · Government & Defense
- Aletex Group 2026-08-14 · Manufacturing
- granjarinya.com 2026-08-14 · Agriculture and Food Production
- Quironsalud 2026-08-10 · Healthcare
- simonrack.com 2026-08-03 · Manufacturing
- The Dcoop 2026-07-31 · Agriculture and Food Production
- DIATER 2026-07-28 · Manufacturing
- Acens | Cloud & Backup 2026-07-26 · Technology
- Postres Reina 2026-07-21 · Agriculture and Food Production
- Acosol 2026-07-17
- Feliubadaló 2026-07-15
- Ferrovial 2026-07-15 · Construction
- URH Hoteliers 2026-07-13 · Hospitality and Tourism
- Aldaco Avance 2022 S.L. 2026-07-12 · Business Services
- abianchini.es 2026-07-11 · Business Services